c/zVgsKKuz/172: enabled reCaptcha for the Contact webform #32
Conversation
WalkthroughThe changes introduce reCAPTCHA v3 integration and CAPTCHA configuration to a Drupal-based project. This includes updating dependencies, enabling the necessary modules, and providing default configuration files for CAPTCHA and reCAPTCHA v3 on various forms. Environment-specific settings for CAPTCHA disabling and reCAPTCHA credentials are introduced, with corresponding updates to environment variables and automated tests. Security settings are adjusted to permit Google reCAPTCHA domains, and Docker Compose is updated to support the new environment variables. No changes are made to exported or public code entities; all changes are either configuration or test updates. Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant Webform
participant CAPTCHA Module
participant reCAPTCHA v3 Module
participant Drupal Config
User ->> Webform: Submits contact form
Webform ->> CAPTCHA Module: Request CAPTCHA challenge (per config)
CAPTCHA Module ->> Drupal Config: Check form-specific CAPTCHA config
alt reCAPTCHA v3 enabled
CAPTCHA Module ->> reCAPTCHA v3 Module: Initiate reCAPTCHA v3 challenge
reCAPTCHA v3 Module ->> User: Display reCAPTCHA v3 widget
User ->> reCAPTCHA v3 Module: Complete challenge
reCAPTCHA v3 Module ->> CAPTCHA Module: Return verification result
else Default CAPTCHA
CAPTCHA Module ->> User: Display default CAPTCHA challenge
User ->> CAPTCHA Module: Submit response
CAPTCHA Module ->> CAPTCHA Module: Validate response
end
CAPTCHA Module ->> Webform: Return validation result
Webform ->> User: Show success or error message
sequenceDiagram
participant CI/Local Environment
participant Drupal Settings Loader
participant CAPTCHA Module
CI/Local Environment ->> Drupal Settings Loader: Load settings.captcha.php
Drupal Settings Loader ->> CAPTCHA Module: Set disable_captcha = TRUE
CAPTCHA Module -->> All Forms: CAPTCHA checks bypassed
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (2)
🔇 Additional comments (5)
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 10
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Lite
⛔ Files ignored due to path filters (1)
composer.lockis excluded by!**/*.lock
📒 Files selected for processing (15)
composer.json(1 hunks)config/default/captcha.captcha_point.contact_message_personal_form.yml(1 hunks)config/default/captcha.captcha_point.node_civictheme_alert_form.yml(1 hunks)config/default/captcha.captcha_point.node_civictheme_event_form.yml(1 hunks)config/default/captcha.captcha_point.node_civictheme_page_form.yml(1 hunks)config/default/captcha.captcha_point.user_login_form.yml(1 hunks)config/default/captcha.captcha_point.user_pass.yml(1 hunks)config/default/captcha.captcha_point.user_register_form.yml(1 hunks)config/default/captcha.captcha_point.webform_submission_contact_add_form.yml(1 hunks)config/default/captcha.settings.yml(1 hunks)config/default/core.extension.yml(3 hunks)config/default/image_captcha.settings.yml(1 hunks)config/default/recaptcha_v3.settings.yml(1 hunks)web/autoload.php(1 hunks)web/sites/default/includes/modules/settings.captcha.php(1 hunks)
🔇 Additional comments (11)
composer.json (1)
26-26:Details
❓ Verification inconclusive
Verify recaptcha_v3 version and compatibility.
The new requirement
"drupal/recaptcha_v3": "^2.0"aligns with the integration of reCAPTCHA v3, but please confirm that version2.xsupports Drupal 11 and is available on Packagist.You can run a quick check against Packagist:
🏁 Script executed:
curl -s https://repo.packagist.org/p2/drupal/recaptcha_v3.json | jq '.[].versions | keys'Length of output: 161
🏁 Script executed:
#!/bin/bash # Check for composer repositories block grep -R '"repositories"' -n composer.json || echo "No 'repositories' key found in composer.json" # Check for Drupal packages repository entry grep -R 'packages\.drupal\.org' -n composer.json || echo "No Drupal repository (packages.drupal.org) found in composer.json"Length of output: 173
Verify drupal/recaptcha_v3 v2.x availability & Drupal 11 compatibility
Thedrupal/recaptcha_v3package is hosted on the Drupal composer repository (https://packages.drupal.org/8), not packagist.org, so your Packagist API check returned 404. Please confirm that version 2.x of this module is published there and supports Drupal 11.• Location: composer.json, line 26
• Verification options:composer show drupal/recaptcha_v3 --all | grep versionsor
curl -s https://updates.drupal.org/release-history/recaptcha_v3/8.x-2.xor review the release list at:
https://www.drupal.org/project/recaptcha_v3/releasesweb/autoload.php (1)
7-7: Confirm updated scaffold attribution.The docblock line was simplified to “This file was generated by drupal-scaffold.”. The change is purely cosmetic, and core autoload behavior remains unchanged.
config/default/core.extension.yml (3)
11-11: Enable Captcha module
Thecaptchamodule has been correctly added to thecore.extension.ymlundermodule:with weight 0, following alphabetical ordering.
42-42: Enable Image Captcha submodule
Theimage_captchamodule is correctly listed alphabetically and enabled to support image-based CAPTCHA.
66-66:Details
✅ Verification successful
Enable reCAPTCHA v3 module and verify Composer dependency
Therecaptcha_v3module has been added with weight 0. Ensure that the corresponding Composer dependency (drupal/recaptcha_v3) is declared so the module is available.
🏁 Script executed:
#!/bin/bash # Verify that drupal/recaptcha_v3 is present in composer.json rg -n '"drupal/recaptcha_v3"' composer.jsonLength of output: 87
Composer dependency for reCAPTCHA v3 verified
Found"drupal/recaptcha_v3": "^2.0"in composer.json (line 26). No further action required.config/default/captcha.captcha_point.contact_message_personal_form.yml (1)
1-10: Correct default Captcha point configuration
The file properly defines the CAPTCHA point forcontact_message_personal_formwith a unique UUID, English language, default type, and disabled status, including the_coreblock.config/default/captcha.captcha_point.user_pass.yml (1)
1-10: Correct default Captcha point foruser_passform
This configuration is consistent with other CAPTCHA point files: it includes a unique UUID,_coredefault_config_hash, English language, default captcha type, and is disabled by default.config/default/captcha.captcha_point.user_register_form.yml (1)
1-9: Approve new CAPTCHA point for user registration form
The configuration correctly adds a disabled (status: false) CAPTCHA point foruser_register_form, aligning with the plan to enable only the contact form by default.config/default/captcha.captcha_point.user_login_form.yml (1)
1-9: Approve new CAPTCHA point for user login form
This adds a disabled (status: false) CAPTCHA for theuser_login_form, consistent with the intended rollout of CAPTCHA only on selected forms initially.config/default/captcha.settings.yml (1)
11-11: Verifywhitelist_ipstype
Thewhitelist_ipskey is set to an empty string. If the schema expects a list of IP addresses, this should be an empty array ([]). Please confirm the expected type and adjust accordingly to avoid runtime errors.config/default/image_captcha.settings.yml (1)
5-15: Verify font URI paths
Theurifields use relative paths undermodules/contrib. Consider using a Drupal stream wrapper (e.g.,module://image_captcha/fonts/...) or validate that these paths remain correct in all environments.
config/default/captcha.captcha_point.webform_submission_contact_add_form.yml
Outdated
Show resolved
Hide resolved
| uuid: 01ef48fc-6bf2-492d-8c4b-7c48fce8e8e5 | ||
| langcode: en | ||
| status: false | ||
| dependencies: { } | ||
| formId: node_civictheme_alert_form | ||
| captchaType: default | ||
| label: node_civictheme_alert_form |
There was a problem hiding this comment.
Missing _core default_config_hash section
The _core section containing default_config_hash is absent. Add it to ensure Drupal can track and import this configuration correctly.
Include:
_core:
default_config_hash: <generated_hash>| image_captcha_rtl_support: 0 | ||
| image_captcha_background_color: '#ffffff' | ||
| image_captcha_foreground_color: '#000000' | ||
| image_captcha_foreground_color_randomness: 100 | ||
| image_captcha_file_format: 1 | ||
| image_captcha_distortion_amplitude: 0 | ||
| image_captcha_bilinear_interpolation: 0 | ||
| image_captcha_dot_noise: 0 | ||
| image_captcha_line_noise: 0 | ||
| image_captcha_noise_level: 5 |
There was a problem hiding this comment.
🧹 Nitpick (assertive)
Unify boolean/integer settings
Flags like image_captcha_rtl_support, image_captcha_bilinear_interpolation, image_captcha_dot_noise, and image_captcha_line_noise use integer values (0). For clarity, consider using boolean (false) if supported, or document that these fields accept numeric levels.
AlexSkrypnyk
added
the
Requires more work
nsineok
force-pushed
the
feature/contact_form_captcha
branch
from
84f5698 to
06a3018
Compare
…enitals to the .env file
There was a problem hiding this comment.
Actionable comments posted: 4
♻️ Duplicate comments (1)
web/sites/default/includes/modules/settings.captcha.php (1)
10-12: Guard against undefined environment setting and simplify condition.Accessing
$settings['environment']without checking may trigger notices if the key is missing. Consider updating to:-if ($settings['environment'] == ENVIRONMENT_CI || $settings['environment'] == ENVIRONMENT_LOCAL) { - $settings['disable_captcha'] = TRUE; -} +if (!empty($settings['environment']) && in_array($settings['environment'], [ENVIRONMENT_CI, ENVIRONMENT_LOCAL], true)) { + $settings['disable_captcha'] = TRUE; +}This avoids undefined index notices and uses strict comparison.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Lite
📒 Files selected for processing (8)
config/default/captcha.captcha_point.webform_submission_contact_form.yml(1 hunks)config/default/captcha.settings.yml(1 hunks)config/default/core.extension.yml(2 hunks)config/default/recaptcha_v3.recaptcha_v3_action.recaptcha3.yml(1 hunks)config/default/recaptcha_v3.settings.yml(1 hunks)config/default/seckit.settings.yml(1 hunks)docker-compose.yml(1 hunks)web/sites/default/includes/modules/settings.captcha.php(1 hunks)
🔇 Additional comments (5)
config/default/core.extension.yml (1)
11-11: Module additions look good!The addition of
captchaandrecaptcha_v3modules with weight 0 properly enables the required functionality for the Contact webform reCaptcha integration.Also applies to: 65-65
docker-compose.yml (1)
68-70: reCaptcha environment variables look good!The environment variables for reCaptcha v3 credentials are correctly added with sensible defaults (empty strings). This supports the credentials configuration in
settings.captcha.php.config/default/recaptcha_v3.recaptcha_v3_action.recaptcha3.yml (1)
1-8:Details
✅ Verification successful
Verify reCaptcha v3 threshold value.
The configuration looks good overall. The threshold value is set to 0.5, which is a middle ground for the reCaptcha v3 score (0.0 to 1.0). Depending on your security needs, you might want to adjust this:
- Higher values (e.g., 0.7) create stricter checks but may increase false positives
- Lower values (e.g., 0.3) are more lenient but may allow more spam
Consider whether 0.5 is appropriate for your use case and security requirements.
🌐 Web query:
What is the recommended threshold value for reCaptcha v3?💡 Result:
The recommended threshold value for reCAPTCHA v3 is 0.5, which is the default setting established by Google for this verification system[1][4]. This threshold represents a middle ground on the scoring scale that ranges from 0.0 (most likely a bot) to 1.0 (definitely human)[3][5].
Understanding reCAPTCHA v3 Thresholds
reCAPTCHA v3 works by analyzing user interactions with your site and assigning a score that reflects the probability of the user being human versus an automated bot. The system operates invisibly in the background without interrupting the user experience[3].
Score Interpretation
- Higher scores (closer to 1.0): Indicate a high probability of genuine human interaction. These users are typically considered legitimate and can proceed without additional verification[5].
- Lower scores (closer to 0.0): Suggest possible bot activity. These users might require additional verification steps to confirm their legitimacy[5][6].
Finding the Right Threshold
While 0.5 is the recommended starting point, the ideal threshold may vary depending on your specific needs:
- Google officially states that "by default, you can use a threshold of 0.5" as a safe starting value[1].
- Over time, you can adjust this threshold based on reviewing traffic patterns in your reCAPTCHA logs or the Google reCAPTCHA admin console.
- Some website owners report needing to lower the threshold (to values like 0.2 or 0.3) to prevent legitimate users from being blocked, while others may need to raise it to better filter out spam[2].
Practical Considerations
Setting the threshold involves balancing security against user experience:
- Too high a threshold may block legitimate users, causing frustration and potentially lost customers[2].
- Too low a threshold may allow spam and bot traffic to pass through your protections[2].
Some site owners report that a significant percentage of valid users might receive scores as low as 0.0, which would require them to complete additional verification steps if the threshold is set too high[7].
If you're experiencing frequent false positives (legitimate users being identified as bots), you might need to adjust your threshold downward. Conversely, if you're seeing increased spam activity, you might need to increase the threshold[2][6].
Citations:
- 1: https://developers.google.com/recaptcha/docs/v3
- 2: https://www.nopcommerce.com/en/boards/topic/96121/recaptcha-v3-score-threshold-issue
- 3: https://www.capsolver.com/blog/reCAPTCHA/recaptcha-v3-solver-human-score
- 4: https://www.tendenci.com/help-files/how-use-google-recaptcha-tendenci-site/
- 5: https://formspree.io/blog/recaptcha-3/
- 6: https://friendlycaptcha.com/insights/recaptcha-v3/
- 7: https://wordpress.org/support/topic/many-valid-users-get-recaptcha-score-of-0-0/
- 8: https://www.drupal.org/project/recaptcha_v3/issues/3132056
Threshold value confirmed: 0.5 is the recommended default
The reCAPTCHA v3 threshold is correctly set to 0.5, which aligns with Google’s official recommendation. No changes are required at this time. Continue to monitor your reCAPTCHA traffic in the admin console and adjust the threshold as needed to balance security and user experience.
File requiring no changes:
- config/default/recaptcha_v3.recaptcha_v3_action.recaptcha3.yml (Lines 1–8)
config/default/captcha.captcha_point.webform_submission_contact_form.yml (1)
1-8: Enable reCAPTCHA v3 on Contact webform
The configuration correctly setscaptchaType: recaptcha_v3/recaptcha3withstatus: trueforwebform_submission_contact_form.
Please verify that theformId(webform_submission_contact_form) exactly matches the machine name of your Contact webform to avoid import/runtime mismatches.config/default/recaptcha_v3.settings.yml (1)
3-4: Document environment-based credential injection
site_keyandsecret_keyare intentionally left blank here. Ensure these are populated via your environment-specific settings (e.g.,settings.captcha.phpor Drupal’s config override) prior to deploying to production.
| if (!empty(getenv('DRUPAL_RECAPTCHA_SITE_KEY')) && !empty(getenv('DRUPAL_RECAPTCHA_SECRET_KEY'))) { | ||
| $config['recaptcha_v3.settings']['site_key'] = getenv('DRUPAL_RECAPTCHA_SITE_KEY'); | ||
| $config['recaptcha_v3.settings']['secret_key'] = getenv('DRUPAL_RECAPTCHA_SECRET_KEY'); | ||
| } |
There was a problem hiding this comment.
🧹 Nitpick (assertive)
Consider setting default values for empty credentials.
The implementation correctly checks if environment variables exist before setting the credentials, but the module might expect these keys to always be present in the configuration. Consider setting default empty values even when environment variables are not defined:
if (!empty(getenv('DRUPAL_RECAPTCHA_SITE_KEY')) && !empty(getenv('DRUPAL_RECAPTCHA_SECRET_KEY'))) {
$config['recaptcha_v3.settings']['site_key'] = getenv('DRUPAL_RECAPTCHA_SITE_KEY');
$config['recaptcha_v3.settings']['secret_key'] = getenv('DRUPAL_RECAPTCHA_SECRET_KEY');
+} else {
+ $config['recaptcha_v3.settings']['site_key'] = '';
+ $config['recaptcha_v3.settings']['secret_key'] = '';
}This ensures the settings are always present in the configuration.
| secret_key: '' | ||
| hide_badge: false | ||
| verify_hostname: false | ||
| default_challenge: captcha\Math |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Fix default_challenge path separator
The default_challenge notation should use a forward slash (/) instead of a backslash.
Apply this patch:
-default_challenge: captcha\Math
+default_challenge: captcha/Math📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| default_challenge: captcha\Math | |
| default_challenge: captcha/Math |
| _core: | ||
| default_config_hash: hfqTr6E3eXAcVQU25_tYHa4BzsSDaYhwkoF34xq5_k4 | ||
| langcode: en | ||
| enable_globally: 0 |
There was a problem hiding this comment.
🧹 Nitpick (assertive)
Unify boolean and integer representations
Fields like enable_globally, default_validation, and persistence mix integers (0/1) with booleans (false/true). For consistency, convert them to boolean literals:
-enable_globally: 0
+enable_globally: false
-default_validation: 1
+default_validation: true
-persistence: 1
+persistence: trueAlso applies to: 13-14
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Lite
📒 Files selected for processing (1)
tests/behat/features/seckit.feature(1 hunks)
🔇 Additional comments (1)
tests/behat/features/seckit.feature (1)
11-11: Extend connect-src to include reCAPTCHA domains
The updated test now correctly asserts that theconnect-srcdirective contains bothhttps://www.recaptcha.netandhttps://www.google.com. This aligns with your CSP configuration changes.
nsineok
force-pushed
the
feature/contact_form_captcha
branch
from
0ea881c to
9216b66
Compare
nsineok
added
Needs review
Checklist before requesting a review
[#123] Verb in past tense.#123added to descriptionChangedsectionhttps://trello.com/c/zVgsKKuz/172-reusable-contact-us-form
Changed
web/sites/default/includes/modules/settings.captcha.phpfile where captcha is disabled for the Local and CI environments.Screenshots
Summary by CodeRabbit
Summary by CodeRabbit