- How do I install and configure laravel-altcha in a Laravel application?
- Install the package with Composer, publish its config file, add the ALTCHA Blade widget to your form, and add the package validation rule to the relevant FormRequest. The default setup is stateless, so no migrations or queue workers are required. The main front-end requirement is injecting the solved token into the submitted payload. Plain Blade forms are straightforward, but Livewire, Inertia, and SPA forms need manual token plumbing.
- Which Laravel and PHP versions does laravel-altcha support?
- Check the package composer.json and its test matrix before installing, because declared PHP and Laravel constraints are the source of truth. It is a thin adapter over altcha-org/altcha, so compatibility also depends on the vendor library version pulled in. Pin the package to ^2.3 and verify the declared support against your runtime during a short spike.
- How do I verify an ALTCHA payload server-side in Laravel?
- Use the package validation rule in your existing FormRequest, just like other Laravel validation rules. Existing $errors handling and redirect flows continue to work unchanged. Ensure the solved ALTCHA token is present in the request payload before validation runs. Test both the valid submit path and the missing or rejected payload path end-to-end.
- Does laravel-altcha work with Livewire and Inertia forms?
- It is drop-in for plain Blade and FormRequest applications. Livewire, Inertia, and SPA forms are workable, but the solved token must be captured and injected manually before submission. Treat that token plumbing as a small integration project rather than assuming the Blade component handles it automatically. Scope the front-end work before rollout.
- Is laravel-altcha stateless, or does it need a database or cache?
- The default path is stateless: no migrations, queue, daemon, or shared state are required, which suits containerized and horizontally scaled deployments. That is a key advantage over third-party CAPTCHA services. However, opting into single-use enforcement reintroduces server-side persistence for consumed solution signatures. That adds a cache or database dependency and requires a shared store across all nodes.
- How does laravel-altcha prevent replay attacks and single-use solutions?
- By default, the package does not enforce single-use solutions, so a solved payload can be replayed within its expiry window. Single-use enforcement is opt-in and is the headline feature intended to address replay. Enabling it requires persisting consumed solution signatures, aligning TTLs with challenge expiry, and deciding whether the system fails open or closed when storage is unavailable. Design that storage path before rollout, not after.
- What CSP settings are needed for the ALTCHA widget and Web Worker?
- Confirm whether the JavaScript widget is vendored and pinned or fetched from a CDN at runtime. If it is loaded from a CDN, allow that origin in script-src and also allow the worker source in worker-src. Missing worker-src is a common silent failure with this class of library. If the widget is vendored, serve it from your own origin and adjust the CSP accordingly.
- Is laravel-altcha a replacement for reCAPTCHA, and does it stop bots?
- It is a privacy-friendly proof-of-work CAPTCHA alternative, not a bot classifier. Proof-of-work raises the cost per request, but it does not stop a funded or targeted attacker and is not suitable for high-frequency API endpoints. It fits ordinary form submission flows where you want to reduce automated abuse without third-party tracking or image puzzles. Scope which forms actually warrant it before building.
- How do I test ALTCHA validation in Laravel feature tests?
- Write feature tests that submit a solved payload and assert validation passes, then submit a missing or invalid payload and assert the expected validation failure. Check that your existing $errors handling still behaves correctly. If you enable single-use enforcement, also test replay rejection and the chosen behavior when the backing store is unavailable. Confirm the package's test matrix covers your PHP and Laravel versions.
- What are the maintenance and supply-chain risks of laravel-altcha?
- It is a single-maintainer community package with a small audit surface and a low bus factor, and the headline single-use feature came from a first-time contributor. Version 2.3.0 is a minor release that pulls altcha-org/altcha v2, a vendor major, so pin both the Laravel package and the vendor library explicitly in composer.json. Avoid wildcard constraints and review upgrade notes if any code calls the vendor library's challenge or verify API directly.