I'm trying to build a simple anti-bot method and currently the version that works is completely written in JS and obviously, it can be easily exploited.
What I'm interested in doing, is to put the nginx server "on break" until the user performs "drag and drop" of an image from among the possible solutions over another image that represents the final solution.
How could I detect in nginx (Lua script) if the user has executed a new drag & drop and if not, just wait but without loading the server too much? (I exclude a while(1) with a timeout of 2-3 seconds because in the case of a DDoS attack this would kill the server).
Also in the logic of Lua which verifies the user's action after a certain number of wrong attempts, he will be permanently redirected to a "denied.html" page, or if he has solved the puzzle correctly, he will be excused for X hours to directly access the requested page. (think cloudflare, it's exactly what I want to do on another level)