- Does gjuric/recaptcha-bundle work with Laravel?
- No. gjuric/recaptcha-bundle is a Symfony bundle (a re-host of the upstream EWZRecaptchaBundle) that integrates through Symfony's kernel/bundle registration, a DI extension, a Form type, a Validator constraint and Twig helpers. Laravel has none of those seams: there is no service provider, no config publish, no Blade directive and no validation rule, so dropping it into a Laravel app yields nothing usable out of the box. The practical approach is to treat the bundle as a reference implementation and reimplement its verification logic natively in Laravel.
- How do I install and configure gjuric/recaptcha-bundle in a Symfony app?
- Install it with Composer, then register the bundle in config/bundles.php so Symfony's kernel boots it, and define your site and secret keys under the bundle's config key (upstream ewz uses ewz_recaptcha) in config/packages. Once the keys are in place you can use the provided RecaptchaType form type and Twig helpers to render the widget and validate submissions server-side. Keep the secret key out of version control and inject it from environment variables.
- Which Symfony and PHP versions does version 1.6.2 support?
- Version 1.6.2 is a deprecation-cleanup patch aimed at Symfony 8.0, so its component constraints sit at or near the Symfony 8 line; it adds no new features and does not change the verification path. Check the composer.json constraint range before assuming compatibility with Symfony 5, 6 or 7, and confirm the required PHP version. Because the fork has zero dependents, Symfony 8 support is untested in the wild, so validate it in a staging branch first.
- Why does Composer report a conflict when installing this bundle in a Laravel app?
- Laravel pins older symfony/* components such as HttpFoundation, Console, Finder and Mime, while a bundle advertising Symfony 8.0 support will require those same components at or near the Symfony 8 line. Composer cannot satisfy both sets of constraints, so the install fails or forces an unsafe downgrade. Even where constraints happen to resolve, the bundle still provides no Laravel integration surface, so a successful install would not give you working reCAPTCHA.
- How do I add reCAPTCHA verification to a Laravel form without this bundle?
- Post to https://www.google.com/recaptcha/api/siteverify using Laravel's HTTP client with your secret, the user's token and the remote IP, then check success, score, action and hostname in the response before accepting the submission. Wrap that in a custom validation Rule (or a FormRequest rule) so controllers stay clean, add a Blade component for the widget and script tag, and keep the site and secret keys in config/services.php driven by env vars. Error-code mapping plus token single-use and two-minute expiry handling are the pieces worth copying from the bundle; the whole port is roughly a few hundred lines and one to two developer days including tests.
- Does the bundle support reCAPTCHA v2 checkbox, invisible v2 and v3 score checks?
- Yes, it supports reCAPTCHA v2 and v3, including the classic checkbox widget, invisible v2 and score-based v3 verification, with server-side validation of the Google response inside the request lifecycle. v3 requires you to inspect the returned score and action and decide your own threshold, since the bundle only surfaces the verification response. reCAPTCHA Enterprise is not covered, so look elsewhere if you need that tier.
- Is gjuric/recaptcha-bundle actively maintained and safe to depend on?
- The code risk is low: MIT licensed, a small surface and a long upstream lineage, and release 1.6.2 shows the fork is actively tracking Symfony releases and clearing deprecation debt. The structural risks remain: zero stars, zero dependents, a single maintainer and the fact that it is a fork that can diverge from upstream ewz. For a production Laravel app, port the logic rather than adding a single-maintainer dependency you cannot patch yourself.
- Should I use this fork or the upstream ewz/EWZRecaptchaBundle?
- They share the same lineage, so the deciding factors are activity and provenance rather than features. Confirm whether the Symfony 8 deprecation fixes in 1.6.2 are fork-only or mirrored upstream, and pick whichever repository shows current maintenance and a constraint range covering your Symfony version. The upstream project has the longer track record but near-zero recent activity, while the fork is the one currently tracking new Symfony releases.
- How do I test reCAPTCHA verification in CI without calling Google?
- Never let tests hit the live siteverify endpoint: in Laravel use Http::fake() to stub the siteverify response with success, score and action values, and assert your rule rejects low scores, wrong actions and expired or reused tokens. If you are testing a Symfony integration directly, mock the bundle's HTTP client instead. Google publishes v2 test keys that always pass, but there is no equivalent always-pass key for v3, so mocking is the reliable path there.
- What production concerns apply to reCAPTCHA v3 score thresholds, fail-open vs fail-closed and GDPR consent?
- v3 scores produce false positives for VPN users, mobile traffic and low-interaction visitors, so tune the threshold against real data and consider falling back to a v2 challenge when the score is borderline. Under GDPR and the ePrivacy Directive, Google's script should not load before the user consents, which usually means gating the widget and the verification call behind your consent flow. Decide explicitly whether an unreachable Google endpoint fails open or fails closed, and log the decision so you can audit blocks later.