A real HTTP redirect doesn't make sense for a JSON API client -- most either
ignore a 3xx or follow it into an HTML page where they expected JSON, which
is worse than a clean failure. Returning error text that includes the web
sign-up URL is what actually reaches a human, since most Mastodon apps
surface that string on-screen when a request fails.
Built for anti-social.online 2026-09-17 after a bot-farm registration wave.
Blocks POST /api/v1/accounts entirely (that's what the bot actually used)
and adds a self-hosted proof-of-work captcha to the web sign-up form as a
second layer. See README for deploy steps and the two gotchas that caused
a follow-up outage the same day (wrong widget build variant, and missing
cache-busting on the vendored JS).
shadowdao