Weave Code
Symfony Altcha Bundle Laravel Package
druidfi/symfony-altcha-bundle
Symfony bundle that integrates Altcha, a privacy-friendly proof-of-work CAPTCHA alternative, into your forms. Adds spam protection without third-party tracking, cookies, or frustrating image puzzles, with straightforward configuration for Symfony applications.
druidfi/symfony-altcha-bundle integrates ALTCHA, a privacy-friendly proof-of-work CAPTCHA, into Symfony applications. It adds spam protection to forms without third-party tracking or intrusive visual challenges.
- Symfony Forms integration for embedding the ALTCHA widget
- Server-side verification of submitted proof-of-work solutions
- Privacy-first design with no cookies or external tracking
- Configurable challenge settings and security keys
- Fits naturally into Symfony’s form validation workflow
Frequently asked questions about Symfony Altcha Bundle
- What does druidfi/symfony-altcha-bundle actually do?
- It integrates Altcha, a proof-of-work CAPTCHA designed as a privacy-friendly alternative to reCAPTCHA, into Symfony applications. The bundle provides a form type you add to your Symfony forms and a validator that verifies the submitted Altcha payload server-side. The overview states it supports both a self-hosted Altcha setup and the hosted Altcha Sentinel service.
- How do I install druidfi/symfony-altcha-bundle with Composer?
- Install it with composer require druidfi/symfony-altcha-bundle. With Symfony Flex the bundle is usually registered automatically; otherwise add it to config/bundles.php. After installation, configure your Altcha HMAC key and any Sentinel credentials as described in the repository README.
- Which Symfony and PHP versions does this bundle support?
- The composer.json in the GitHub repository lists the exact Symfony and PHP constraints, so check that file or the Packagist page before adopting it. The bundle depends on Symfony's Form and Validator components, so it targets Symfony releases where those APIs are current. If you are on an older Symfony version, run composer why-not to confirm compatibility.
- How do I add the Altcha CAPTCHA to a Symfony form with this bundle?
- You add the bundle's Altcha form type as a field in the Symfony form you want to protect, alongside your existing fields. Because Altcha renders a small JavaScript widget, make sure the Altcha script is loaded on the page that renders the form. Validation then runs as part of $form->isValid() like any other form constraint.
- Can Altcha be self-hosted, or do I need an Altcha Sentinel account?
- Both modes are supported according to the package overview. Self-hosted Altcha issues and verifies challenges on your own server using a shared HMAC key, so no traffic leaves your infrastructure. Sentinel is Altcha's hosted API and offloads challenge generation and verification, but adds an external dependency and vendor account.
- How do I configure the Altcha HMAC key or Sentinel credentials in Symfony?
- Configuration is handled through Symfony bundle configuration, so you set the HMAC key or Sentinel credentials in a config file and inject them from environment variables. Keep the key out of version control and use a strong, unique secret in production. The same key must be used for issuing and verifying challenges, so treat it as shared application state.
- How does server-side validation of the Altcha payload work?
- You attach the bundle's Altcha constraint to the form field carrying the payload, or invoke it through Symfony's validator service directly. The validator checks the payload signature and, in a self-hosted setup, verifies that the proof-of-work solution matches your key. Invalid, tampered or expired payloads surface as normal form validation errors.
- How do I test forms protected by Altcha in PHPUnit or Symfony functional tests?
- Rendering and solving the JavaScript widget is not possible in a headless test, so the usual approach is to relax the Altcha constraint in the test environment configuration. You can also generate a valid payload with the underlying Altcha PHP library in your test setup and submit it with the form. Keep at least one integration test running real verification against a known key so the wiring stays covered.
- Does Altcha verification work in production behind a proxy or CDN?
- Verification is a normal server-side check, so it works behind reverse proxies and CDNs as long as the request body reaches your application unmodified. Confirm that the Altcha script and the challenge endpoint are reachable if you cache pages or terminate TLS at the edge. Rate limiting the verification endpoint is a sensible extra safeguard against abuse.
- What are the alternatives to this bundle, and is it actively maintained?
- Alternatives include reCAPTCHA, hCaptcha, Friendly Captcha and Cloudflare Turnstile, as well as wiring the Altcha JavaScript and PHP libraries into Symfony yourself without a bundle. This package is a thin wrapper maintained by Druid, so review recent commits, open issues and release activity in the GitHub repository before committing to it. Checking the license and README is also worthwhile during evaluation.
Weaver
How can I help you explore Laravel packages today?