v1.29.0
This release changes startup behaviour. Read the breaking change before upgrading.
Breaking
A signing secret is now required to start.
Go, Node and Python fail closed when FCAPTCHA_SECRET is absent, or when it is still set to the public development key dev-secret-change-in-production. Zero-configuration startup used to succeed with that key — and a token signed with a key published in this repository can be minted by anyone who has read it. The exported Node scoring library applies the same requirement.
If you already set FCAPTCHA_SECRET, nothing changes for you.
If you did not, the server will now refuse to boot with:
FCAPTCHA_SECRET is required and must not be the public development key.
For local-only development, explicitly set FCAPTCHA_INSECURE_DEV_MODE=1.
Two ways forward:
- Production, and anything reachable from a network: set
FCAPTCHA_SECRETto a value of your own. Any tokens issued under the old default should be treated as forgeable — rotating the secret invalidates them, which is the point. - Local development only: set
FCAPTCHA_INSECURE_DEV_MODE=1. This starts with the public key and prints a warning on every boot. Never expose a server started this way.
Docker Compose now requires the secret to be interpolated rather than supplying a predictable fallback of its own.
Security
Public request bodies are bounded. All three servers cap requests at 64 KiB and reject anything larger with HTTP 413 and {"error":"request_too_large"} — before JSON or form parsing rather than after, so an oversized body is never decoded. Declared-length and chunked requests are both covered.
The ceiling was chosen against the committed browser traces, which run 10–15 KiB: 64 KiB leaves more than four times the observed maximum while bounding the memory and parsing work an unauthenticated caller can cause. Enforcement is covered by an end-to-end invariant that all three implementations share, so the limit cannot drift apart between them.