- How do I install gog/recaptcha-firewall in a Laravel application?
- Install it with Composer using composer require gog/recaptcha-firewall, then publish the package configuration and add your reCAPTCHA site key and secret key to the .env file. Next, register the middleware alias in your HTTP kernel (or bootstrap/app.php on Laravel 11+) and attach it to the route groups you want to protect. The whole integration is measured in hours, not sprints, and requires no database schema changes in the typical case. Check the repository README for the exact vendor:publish tag and alias name before wiring it up.
- Which Laravel and PHP versions does gog/recaptcha-firewall support?
- The package metadata does not publish a clear compatibility matrix, so you should read the composer.json constraints and any CI configuration in the repository before committing to it. Laravel's middleware and service-provider contracts shift between major versions, so support for your specific Laravel and PHP combination needs to be confirmed rather than assumed. Run it in a time-boxed spike against your actual framework version first.
- Does this package use reCAPTCHA v2 or v3?
- This is not documented in the package metadata, and the name implies a firewall abstraction that could hide any of several mechanisms. It may wrap reCAPTCHA v2 (checkbox widget), v3 (score-based with a threshold), or a custom entropy and penalty system with stored state. Confirm which one before designing your front end, because v2 requires rendering a widget while v3 requires attaching a token to each request and tuning a score threshold.
- How do I limit the middleware to specific routes instead of the whole app?
- Register the middleware alias first, then attach it only to the route groups that actually need abuse protection, such as registration, login, contact forms, and checkout. Applying a captcha gate globally adds friction to every request and increases latency and the blast radius of any verification bug. Scoping it to high-value endpoints is the intended pattern for this kind of application-layer perimeter control.
- What happens when Google's reCAPTCHA API is unreachable or returns a 5xx error?
- The fail-open versus fail-closed behavior is not confirmed in the package documentation and is the single most important thing to verify in a spike. Failing open means an outage at Google silently disables your bot protection, while failing closed means a Google outage locks legitimate users out of your application. Test both scenarios explicitly and check whether the behavior is configurable, since your tolerance depends on the endpoint being protected.
- Is gog/recaptcha-firewall safe and maintained enough for production?
- The package shows zero dependents and no reported star count, which means there is no ecosystem evidence of production use outside the maintainer's organization. gogcom is GOG's GitHub organization, and internally published packages are often released for convenience and left unsupported. Treat it as a candidate for a time-boxed spike rather than a committed architectural component, and check the last commit date, issue responsiveness, license, and whether a security disclosure process exists.
- Can I use this middleware to protect API routes and SPA form submissions?
- The middleware sits in the HTTP request pipeline, so it can guard JSON endpoints as well as traditional form posts, but your client must obtain a reCAPTCHA token and send it with each request. You will need to confirm whether the package reads the token from a configurable request field or header, and how it responds to failures (typically a 4xx) so your front end can handle it gracefully. It is a poor fit for stateless edge or worker runtimes and for multi-tenant setups that need per-tenant keys.
- How do I test routes protected by a reCAPTCHA middleware in Laravel?
- Fake the outbound verification call with Laravel's HTTP client fakes so your test suite never hits Google's live API, then write cases for both a valid and an invalid token. Pay particular attention to the bypass paths: missing token, malformed token, low score, and an unreachable verification service. If verification happens synchronously on every request, your tests must account for that extra call or they will be slow and flaky.
- Where should I store the reCAPTCHA secret key, and does this package send user data to Google?
- Keep the site key and secret key in environment variables and never commit them to the repository, using the package config file only to read from env. Every gated request sends the user's IP address and the reCAPTCHA token to Google's servers, which introduces latency, quota, availability, and privacy exposure. If you operate under GDPR or similar regimes, review whether a third-party captcha call is acceptable and whether consent or a data processing agreement is required.
- Do I still need rate limiting and a WAF if I use gog/recaptcha-firewall?
- Yes. This is an application-layer perimeter control aimed at targeted abuse mitigation on high-value endpoints, not a replacement for a WAF, CDN bot management, or rate limiting. Keep your existing controls untouched and evaluate whether the package adds meaningful protection or just redundant friction if you already run Cloudflare or Akamai bot management. Alternatives worth comparing include better-established Laravel reCAPTCHA packages and Cloudflare Turnstile or hCaptcha, which avoid sending data to Google.