Skip to content

v1.25.0

Choose a tag to compare

View all tags
@cport1 cport1 released this 20 Aug 13:49
· 12 commits to main since this release
v1.25.0
c820177

The widget is now on npm and a CDN, minified, with Subresource Integrity.

Added

@webdecoy/fcaptcha-client — the browser widget as its own package, so you no longer need a running server to put a script tag on a page.

<script
  src="https://cdn.jsdelivr.net/npm/@webdecoy/fcaptcha-client@1.25.0/dist/fcaptcha.min.js"
  integrity="sha384-NUXDBR9n6V8EMm/hRTuqt+0RtT0DqQ9Z8iMrxKCLmEJNoMZ1ET8b7Sr5FG6od+6u"
  crossorigin="anonymous"></script>

Self-hosting remains the default and is still what every server does same-origin — no third party sees your visitors, and there is no external dependency to fail. The CDN build is for the try-it path and for anyone who would rather not serve the widget themselves.

  • Minified build: 131.8 KB → 67.6 KB, 17.5 KB over the wire with Brotli.
  • Subresource Integrity digests for both files, published per release. If you use the CDN, pin the version and use the hash: a captcha is the control deciding whether a request is trusted, so a CDN that can silently swap it can turn it off.

Integrity — 1.25.0

fcaptcha.js           sha384-8zD/j0exBDDNovnIl5v8BiOoSRIyFlSYKBEp3PbXVF4mzHLt6oialOGaMKhRn3gw
dist/fcaptcha.min.js  sha384-NUXDBR9n6V8EMm/hRTuqt+0RtT0DqQ9Z8iMrxKCLmEJNoMZ1ET8b7Sr5FG6od+6u

Notes

The minified bundle is verified to behave identically to the source: a browser test loads both in one context and asserts identical canvas fingerprints, signal shape, version and language set. The build additionally refuses to emit a bundle whose fingerprint string literals did not survive minification, and refuses to run at all when the widget and package manifest disagree about the version.

No detection changes.

Assets 2
Loading