go-altcha

ALTCHA is a simple self-hosted alternative to CAPTCHA.

This is an implementation of the server side in Go.

Caveats

This implementation deviates from the specification in two minor ways:

1. The signatures are encoded using base64 instead of hex. This provides a more compact representation, and is still compatible.

2. The HTTP handler middleware adds a WWW-Authenticate header when outputting the JSON formatted challenge, and returns a status code of 200. This is unnecessary, and technically incorrect. However, it allows for using the widget and the M2M variant with the same endpoint.

This was written for testing and comparison with other alternatives for CAPTCHA. The code is intended to be suitable for production use. However, I have not evaluated the effectiveness of this challenge/response algorithm against real world adversaries. Similar proof-of-work challenges exist, such as Hashcash, which I have seen implemented in production systems with varying success.

Usage

The simplest way to use this code is as a HTTP handler middleware.

package main

import (
	"github.com/k42-software/go-altcha/http" // altcha
	"net/http"
)

func main() {
	fileServer := http.FileServer(http.Dir("."))
	http.HandleFunc("/altcha.min.js", altcha.ServeJavascript)
	http.Handle("/protected.html", altcha.ProtectForm(fileServer))
	http.Handle("/", fileServer)
	_ = http.ListenAndServe(":3003", http.DefaultServeMux)
}

See the example directory for a more detailed working example.

Alternatively, you can call the ALTCHA library functions directly.

package main

import "github.com/k42-software/go-altcha"

// Generate a challenge
challenge := altcha.NewChallengeEncoded()

// Generate a response
response, ok := altcha.SolveChallenge(challenge, altcha.DefaultComplexity)
if !ok {
    panic("failed to solve challenge")
}

// Validate the response (true for replay prevention)
valid := altcha.ValidateResponse(response, true)

if valid {
    // Success
} else {
    // Failure
}

License

This project is covered by a BSD-style license that can be found in the LICENSE file.