Suggestion:

401 requires the originating server to send a WWW-Authenticate header field which I don't think happens in this case and 403 has similar requirements. From RFC 2616 I think a 400 would be the best:

400 Bad Request

The request could not be understood by the server due to malformed syntax. The client SHOULD NOT repeat the request without modifications.

Yep, right, not exactly a 401 (even a 400 in fact).

Currently seems you can use https://github.com/LimeSurvey/LimeSurvey/blob/f62a73c8ff91a4d501517fc6cd4532cab1da6231/application/controllers/survey/index.php#L478 onSurveyDenied event : and then log it or send a 400 ?

Looks promising! So what's the next step to log this information? Even if tweaked locally before any kind of update. I'm not such a great code maven.

+1

While I think that this is a nice idea I wonder a little about the benefit. If you successfully find a valid token, what can you do with it? And maybe even more important: Why should you do that at all? What's your benefit?

Valid token : user information : can be a great great great benefit. You don't known what our user do with LimeSurvey …
There are medical system, account system etc …

I agree, if the survey is not anonymous and user details are embedded at the survey, that is indeed a risk.

I'm trying to understand the responses. The only benefit is to block malicious behavior against token entries, and thereby prevent a malicious user from gaining access to a survey. From my position it seems this can be easily done by logging failed token access attempts to a custom log file, and then blocking that IP address with programs like csf (ConfigServer) and others.

FYI: programs like ConfigServer and Fail2Ban simply monitor repeated failed attempts in log files and then block them by IP after X attempts.

@bulgin : yes , but fail2ban can track 400 error directly too
Yes : can actually done with onSurveyDenied event , it's what i put in https://bugs.limesurvey.org/view.php?id=14710#c51247

@DenisChenu Yes, I saw your reference. Just don't understand how I can integrate that for desired result or were you just identifying an area of the code were this information is already captured? So my question is: now what?

See a sample plugin : https://github.com/LimeSurvey/LimeSurvey/blob/master/plugins/Demo/ShowResponse/ShowResponse.php

Add this (not tested) in the function

\Yii::log("Bad token entered", error, 'plugin.logToken.Error');

Use Yii to log it where you want exactly : https://manual.limesurvey.org/Optional_settings#Logging_settings

Since this is an advanced feature I'm setting user value/users affected to 10%. Let me know if you disagree with this.

Since this is an advanced feature I'm setting user value/users affected to 10%. Let me know if you disagree with this.

We have a disable by IP too :) can be improved (separation with admin part), but yes.

Have a token code only is hard to do.