- How do I install gregwar/captcha in a Laravel app?
- Run composer require gregwar/captcha. There is no Laravel service provider or config file to publish; instantiate Gregwar\Captcha\CaptchaBuilder in a controller or service. The image can be returned from a route, and the phrase must be stored server-side for later validation.
- Is gregwar/captcha a Laravel package or framework-agnostic?
- It is a framework-agnostic PHP library rather than a Laravel package. It provides no service provider, facade, config file, Blade component, or built-in validation rule, so the HTTP and session glue is application-owned. In Laravel you typically add a controller action, a route for the image, session storage, and a validation rule or helper around testPhrase().
- How do I use gregwar/captcha with Laravel session validation?
- In the controller that builds the image, call build(), read getPhrase(), and store that phrase in the session. On form submission, recreate CaptchaBuilder with the stored phrase or otherwise compare the submitted value, then call testPhrase($userInput). After validation, remove the session phrase so it is single-use, enforce an expiry timestamp, and rate-limit attempts. The library only compares strings; replay prevention and binding to the form flow are your responsibility.
- Which Laravel and PHP versions does gregwar/captcha support?
- gregwar/captcha is not tied to a specific Laravel version because it is framework-agnostic. The v2.x line requires PHP 8.2 or newer, while applications on older PHP versions must pin v1.x. v2.0.0 was a breaking release with typed signatures and removed classes, and v2.1.0 introduced CSPRNG phrase generation. Prefer v2.1.1 or later where possible because the CSPRNG change is security-relevant.
- How do I customize CAPTCHA width, height, font, colors, and background?
- Call build($width, $height, $font) to control dimensions and font, and call setDistortion() before build() to toggle distortion. Use setBackgroundColor(), setBackgroundAlpha(), and setBackgroundImages() for backgrounds and transparency. For custom background images, disable image effects as recommended; forcing a background color disables many effects and is not recommended.
- Can I output or inline the CAPTCHA image in Laravel?
- Use output() directly with a Content-Type: image/jpeg header, or return the bytes from get() in a Laravel response with the same header. inline() returns a data URI that can be placed in an img src, which is the lowest-effort option but embeds the image in the HTML. save() is also available if you need a file on disk, though that is usually unnecessary for form CAPTCHAs.
- How do I test CAPTCHA input with testPhrase and prevent replay?
- testPhrase($userInput) compares the submitted string with the builder phrase; it does not know about sessions, expiry, or form binding. Store the phrase server-side, recreate the builder with that phrase on submission or wrap a constant-time comparison, then invalidate it immediately after success. Add a short TTL, bind the challenge to the form or action, and rate-limit failures to reduce brute force. A naive $_SESSION example from the README is replayable if you never clear or expire the value.
- What production requirements does gregwar/captcha need in Docker?
- The critical runtime requirement is the GD extension plus font files available to PHP inside the container. Verify both in your Dockerfile and CI image, because missing GD or fonts is the most common integration failure. The OCR methods buildAgainstOCR() and isOCRReadable() shell out to ocrad and ImageMagick, so do not rely on them in production containers; treat OCR hardening as local tuning.
- Is gregwar/captcha secure enough for production, and what about accessibility?
- This is suitable for reducing opportunistic form spam and basic scraping, not for credential stuffing, funded abuse, or determined attackers. Its anti-OCR tuning targets ocrad, a legacy tool, and does not provide assurance against modern ML solvers or CAPTCHA-farming services. An image-only challenge also creates a WCAG accessibility liability, so you need an audio alternative, allowlist, or separate verification path. If accessibility is a hard requirement and no alternative can ship, treat it as a blocker.
- What are alternatives to gregwar/captcha in Laravel, and how is maintenance?
- Alternatives include managed challenge services, honeypot fields, rate limiting, and Laravel-specific CAPTCHA packages or wrappers; choose based on threat model and accessibility requirements. gregwar/captcha is MIT-licensed and small enough to audit or fork, but it is low-velocity and effectively single-maintainer despite its star count. v2.x is modernized with PHP 8.2+, strict typing, package-specific exceptions, and CI static analysis, but do not expect rapid fixes for novel solver techniques. The dependent-count metadata is noisy, so reason from visible wrappers and your own maintenance capacity.