Friendly captcha - #6546
Conversation
Switch the registration and password-reset bot protection from hCaptcha to Friendly Captcha v2 for its privacy-first, adaptive (Smart mode) challenge model that lets legitimate users pass without interaction. - Verify solutions server-side against the global siteverify endpoint using X-API-Key header auth and a JSON body. - Configure via FRIENDLY_CAPTCHA_SITEKEY and FRIENDLY_CAPTCHA_API_KEY. - Gate the form submit button until the widget completes (re-disabling on error/expire), as recommended by Friendly Captcha.
Drop the per-form attribution slot and render a single shared attribution inside the widget component, simplifying both call sites.
|
| if not PlausibleWeb.Captcha.enabled?() or | ||
| PlausibleWeb.Captcha.verify(params["h-captcha-response"]) do | ||
| PlausibleWeb.Captcha.verify(params["frc-captcha-response"]) do |
There was a problem hiding this comment.
Nitpick: We could omit the not PlausibleWeb.Captcha.enabled?() check here (as password reset does). verify returns true if not enabled anyway.
Same goes for line 262 in this file (non-invitation register event handler).
| <.button | ||
| id="register" | ||
| type="submit" | ||
| class="w-full" | ||
| mt?={false} | ||
| x-data={"{ captchaReady: #{not PlausibleWeb.Captcha.enabled?()} }"} | ||
| x-on:frc-captcha-ready.window="captchaReady = true" | ||
| x-on:frc-captcha-reset.window="captchaReady = false" | ||
| x-bind:disabled={"!captchaReady || #{@disable_submit}"} | ||
| > |
There was a problem hiding this comment.
Currently, a failed submit (for whatever reason, e.g. email already exists) will use up the one-time token and the next submit is guaranteed to fail with a "Please complete the captcha" error. Only a page refresh will fix that, meaning that the user needs to fill out all the fields again.
In LiveViews, when a form submit failure comes back from the server, we should make sure to reset the captcha automatically.
There was a problem hiding this comment.
Thanks for catching that! Solved here: ceed565
dee11b6 to
ceed565
Compare
4 participants
Changes
Replaces hCaptcha with invisible Friendly Captcha. Due to the 'invisible' part, some frontend complexity is necessarily added.
NB⚠️ Do not merge. Requires Friendly Captcha credentials to be set up on prod before deploying.
Tests
This part is manually tested.
Changelog
Documentation
Dark mode