- Can I use gregwar/captcha-bundle in a Laravel application?
- No. gregwar/captcha-bundle is a Symfony bundle that registers a CaptchaType for Symfony's Form component; it is not a Laravel package and does not integrate with Laravel's validator or form builder. For Laravel, use the underlying standalone gregwar/captcha library directly or choose a Laravel-specific CAPTCHA/anti-bot package. Scope this bundle only for Symfony applications.
- How do I install and register gregwar/captcha-bundle?
- Run composer require gregwar/captcha-bundle. With Symfony Flex the bundle is auto-registered; without Flex, add GregwarCaptchaBundle\GregwarCaptchaBundle::class to config/bundles.php. Bundle 2.3+ requires PHP 8.0.2+ and Symfony 6, 7, or 8. Optionally create config/packages/gregwar_captcha.yaml for global settings.
- How do I add a captcha field to a Symfony form?
- Add the field with $builder->add('captcha', CaptchaType::class) after importing Gregwar\CaptchaBundle\Type\CaptchaType. By default the generated image is embedded in the HTML document, so you do not need a route or subrequest. You can override width, height, and other options per field. The form type handles validation against the session-stored phrase.
- Which Symfony and PHP versions does gregwar/captcha-bundle support?
- Bundle 2.3+ supports Symfony 6.*, 7.*, and 8.* on PHP 8.0.2 or newer. Older lines target older stacks: 2.2 for Symfony 5–6, 2.1 for Symfony 4–5, and 2.0 for Symfony 2.8–3.*. Check the README compatibility table before upgrading Symfony or PHP.
- How do I configure width, height, storage, and expiration for the captcha?
- Use global YAML under gregwar_captcha for width, height, image_folder, web_path, gc_freq, and expiration. width and height can also be set on the CaptchaType field itself. image_folder is relative to the public web path when as_file is enabled, and expiration defaults to 60 minutes with gc_freq at 100. If you enable as_url, import the bundle routing and review session storage for multi-server setups.
- How do I test a Symfony form that uses CaptchaType?
- The bundle does not ship a dedicated testing helper; the expected phrase is stored in the session, so functional tests must seed or stub that session value. Prefer bypassing or mocking the CAPTCHA constraint in test configuration rather than parsing images in CI. If you use bypass_code, restrict it strictly to test environments and never in production.
- Is gregwar/captcha-bundle accessible and WCAG compliant?
- It renders a visual image/text CAPTCHA with distortion and lines and offers no audio or alternative challenge path, which is a WCAG risk. Teams with accessibility or compliance requirements should evaluate accessible vendor options such as hCaptcha or reCAPTCHA, accepting their own vendor and tracking trade-offs. This bundle has no invisible or behavioral mode.
- How secure is gregwar/captcha against bots and spam?
- It is a traditional image/text CAPTCHA, and OCR or machine-learning solvers are well known to defeat this class of challenge. It reduces naive bot spam but is not serious anti-abuse protection against determined or targeted automation. Treat it as spam reduction and combine it with rate limiting, honeypots, and monitoring.
- Is gregwar/captcha-bundle actively maintained and production-ready?
- It is a single-author MIT-licensed project with around 351 GitHub stars and a low release cadence, though recent releases exist and Symfony 8 support was added. MIT licensing limits lock-in because the underlying gregwar/captcha library is standalone and can be forked or used directly. For production, assign ownership for security patches and monitor upstream activity.
- What should I use instead of gregwar/captcha-bundle for Laravel or API-only backends?
- For Laravel, use the standalone gregwar/captcha library directly or a Laravel-specific CAPTCHA/anti-bot package; this bundle is Symfony-only. For SPA, headless, or API-only backends, server-rendered image CAPTCHAs are a poor fit, so use a vendor anti-bot service or a token-based challenge. The bundle is appropriate only for server-rendered Symfony forms.