How does "hash" work in the context of the Contact Form?

Question

I'm running into some trouble using the "hash" filter in Craft's first-party Contact Form plugin. The docs suggest using it like so:

<input type="hidden" name="redirect" value="{{ 'contact/thanks?from={fromName}'|hash }}">

On my development site, this is redirecting an otherwise-successful form to domain.com/hash_valuecontact/thanks?from=name, and therefore a 404 page.

Changing the value to '/contact/thanks?from{fromName}'|hash results in a more proper URL (domain.com/hash_value/contact/thanks?from=name) but still a 404. The docs suggest the hash is prepended to the value so the URL is expected but I'm not sure how the hash is decoded. And since the name is sent via the query string, I'm not sure what the hash is really doing in the first place, or why it's important.

So my question—is the hash actually important in this context, and if so how is it implemented? The docs don't contribute much information there. Thanks for any help.

Answer 1

In the context of the Contact Form plugin, the |hash filter is only necessary if you want to dynamically add recipients to the submission.

It is there to ensure that data isn't tampered with between the time it is submitted and the time that it hits Craft. Contact Form cares about this so malicious people/scripts don't turn your Craft install into an email SPAM relay machine.

Looks like you're using it on the hidden redirect parameter... it's completely unnecessary there, so you can remove it.