Anonymous comments

[gruessung]

trafficstars

Hi,

is there a possibility to comment without login?

[leviwheatcroft]

I'd like to see this.. in some use cases it would invite an overwhelming amount of spam, but in other cases it might be appropriate.

[gka]

schnack is using passportjs as auth framework, and from what I see there is a provider for anonymous "authentication". so I guess we could just plug this in like any other provider.

[leviwheatcroft]

I had a quick look at this, I guess there would be two approaches to implement.

No Login Comment Approach

• if (!data.user) show the comment box ready to go with a "comment anonymously" button
• and underneath say something like "login with these services (optional)"
• easy to implement anonymous auth using passport-anonymous or passport-anonym-uuid, basically these would let POST requests to /comments/:slug without a user.
• requires extensive changes to src/embed/comments.jst.html
• this approach has the least friction, you'd get more comments but more susceptible to spam bots

Login as Anonymous Approach

• if (!data.user) just render the login as it is, but include a button for anonymous login.
• I'm not sure whether the passport plugins mentioned above would be the right approach for this because they don't set anything in the session so I'm not sure how they could be used to determine whether a user has chosen to login as anonymous instead of using one of the oauth providers. However, I think this would be fairly easy to implement using BasicStrategy
• with this approach you could use haikunator or similar to generate random usernames like purple-breeze, patient-king, cold-wildflower, this might be a nice touch. With this approach anonymous commenters would retain the same name for as long as their session lasted.

I think the "Login as Anonymous" approach is more sensible.

[gka]

I think my preferred solution for anonymous commenting would be to allow users to enter a name of their own liking. of course, if the field is left empty we could fall back to random user names.

[leviwheatcroft]

Entering a name of your own choice would be nice, but is there an implication that you could enter the same name each time you visit ? If you could do that, then others could also enter that name.

[gka]

I think that is a known and accepted side-effect of posting anonymously. if you want to authenticate yourself as the legitimate author you can always chose to sign in via twitter/github/facebook/mastodon etc

[RafidMuhymin]

It's been two years since the last response. Is anyone working on the feature?