Skip to content

Allow /siteverify endpoint and remove the need to give a key#217

Closed
DorianCoding wants to merge 543 commits intotiagozip:mainfrom
DorianCoding:siteverify
Closed

Allow /siteverify endpoint and remove the need to give a key#217
DorianCoding wants to merge 543 commits intotiagozip:mainfrom
DorianCoding:siteverify

Conversation

@DorianCoding
Copy link
Copy Markdown
Contributor

Hello,

On the default cap implementation, it is written:

Once a user completes the CAPTCHA, your backend must verify the token before trusting it. Send a POST request to your instance's /siteverify endpoint with the following JSON body:

This is not the way hCaptcha, reCaptcha, ALTCHA works as they all have a unique endpoint. This forces the server to know the site key and the secret key. And the implementation used allows to verify the site key without any additional payload and with background compatibility by just splitting the token.

  • Backward compatibility: The use of the old endpoint is still valid and the sitekey is checked again. The use of the new /siteverify endpoint is also possible.
  • Avoid mitigation: The token sent and stored already contains the site key and it is not possible to solve a challenge on a lower difficult site key and make it usable on an harder one.

Thank you.

tiagozip and others added 27 commits March 11, 2026 11:06
- Fix Swagger API version (2.0.0 → 3.0.0)
- Fix private IP detection for 172.16.0.0/12 range in ipdb
- Fix ipinfo cache eviction (O(n log n) sort → O(n) single-oldest)
- Batch key deletion with Promise.all (14 sequential ops → parallel)
- Update docs: docker-compose now includes Valkey, remove stale SQLite/DB_URL references
- Update docs: instrumentation challenges messaging (now default)
- Fix widget .solve() progress ring not animating when called during speculation fetch/wait

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.