Weave Code
Altcha Laravel Package
altcha-org/altcha
ALTCHA for PHP offers a privacy-first, self-hosted CAPTCHA alternative using proof-of-work. Generate and verify challenges server-side, protect forms without cookies or tracking, and integrate easily into Laravel/PHP apps. GDPR-friendly and simple to deploy.
ALTCHA is a PHP library for adding privacy-friendly proof-of-work CAPTCHA protection to forms and APIs. It generates signed challenges and verifies submitted solutions server-side, offering a cookie-free alternative to traditional CAPTCHAs without tracking users.
- Challenge generation with configurable difficulty
- Server-side verification of submitted solutions
- HMAC-signed payloads to prevent tampering
- Framework-agnostic PHP integration
- GDPR-friendly, no cookies or user profiling
Frequently asked questions about Altcha
- How do I install altcha-org/altcha in a Laravel app?
- Run composer require altcha-org/altcha and commit the lock file. The library is plain PHP, so you then add your own Laravel glue: a config file for the HMAC secret and challenge options, a service provider binding, and a controller that returns challenges. No migrations, queues, or PHP extensions are required.
- Is altcha-org/altcha Laravel-specific or framework-agnostic?
- It is deliberately framework-agnostic server-side PHP for creating challenges and verifying solutions. It is not a Laravel package, so it does not ship a service provider, facade, config file, Blade component, or validation rule. In Laravel you wrap it in a thin internal package or app-level service.
- Which Laravel and PHP versions are supported by altcha-org/altcha?
- The library targets PHP 8.x and has no Laravel coupling, so any Laravel version running on a supported PHP 8 release can use it through Composer. Because it does not declare Laravel version constraints, your app owns compatibility testing. Pin the package and run your own CI against the Laravel and PHP versions you deploy.
- How do I verify an ALTCHA solution server-side in Laravel?
- Create the challenge server-side with your secret and options, send it to the official ALTCHA widget, then verify the submitted payload with the library before accepting the form. In Laravel, put verification in a custom Rule, FormRequest, or middleware so every protected endpoint uses the same path. Return a generic validation error on failure and log enough context to diagnose secret or expiry mistakes.
- How do I configure the ALTCHA HMAC secret, algorithm, maxNumber, and expiry?
- Keep the HMAC secret in your secrets manager and expose it through Laravel config and environment variables, never in client code. Pass the same secret and algorithm to challenge creation and verification, and set maxNumber and expiry to values you have tested against your slowest supported devices. Add a rotation runbook because a mismatched or rotated secret breaks verification.
- Do I need Redis or a database for ALTCHA challenges in Laravel?
- No, the basic design is stateless: verification is an HMAC signature check, so you do not need Redis, sessions, or cookies. If you require single-use challenges and replay protection, you must add a cache or Redis store keyed on the challenge signature with a TTL. Treat that as a deliberate stateful design decision, not a default requirement.
- What are the CSP and HTTPS requirements for the ALTCHA widget?
- The ALTCHA widget uses Web Crypto and workers, so serve your forms over HTTPS, including staging, because secure context is required. Your Content-Security-Policy must allow the widget script and worker execution, typically script-src for the widget and worker-src blob:. Self-hosting the widget JavaScript reduces third-party runtime dependency but still needs CSP and cache testing.
- How should I test an ALTCHA integration in Laravel?
- Unit test challenge generation and verification with known secrets and expiry cases, then feature test your Laravel endpoint and validation rule. Use test payloads generated in the test rather than bypassing verification in production code. Also test misconfigured secrets, expired challenges, CDN caching of the challenge endpoint, and the fallback path for clients that cannot solve.
- What production concerns should I watch with an ALTCHA proof-of-work CAPTCHA?
- ALTCHA is cost-imposition, not proof of humanity, so use it as spam mitigation and not as an authentication or risk-scoring control on high-value surfaces. Watch PoW solve times on low-end mobile devices and battery-saver modes, and provide an accessible fallback. Protect the challenge endpoint from CDN caching, rotate secrets safely, and decide explicitly whether replay protection needs Redis.
- What alternatives to altcha-org/altcha exist for Laravel CAPTCHA?
- The common alternatives are reCAPTCHA and hCaptcha, which add third-party scripts, tracking, and data-processor relationships, while ALTCHA is privacy-friendly and GDPR-oriented. If you want a Laravel-native adapter, check whether a maintained package exists and who owns it; otherwise keep a thin internal wrapper around altcha-org/altcha. Because ecosystem signals are thin, pin the version and keep an MIT-licensed fork plan.
Weaver
How can I help you explore Laravel packages today?