- Can I use huluti/altcha-bundle in a Laravel application?
- No. huluti/altcha-bundle is a Symfony bundle: it registers a Bundle subclass, wires services through Symfony's DI container, and relies on Symfony's configuration tree and autoconfiguration. Laravel has no bundle lifecycle, so adopting it would mean pulling symfony/http-kernel, symfony/dependency-injection, and symfony/config into an app that already has its own container. That is not a production-ready path for a Laravel stack.
- Is huluti/altcha-bundle a Laravel package or a Symfony bundle?
- It is a Symfony bundle, not a Laravel package. Its integration surface is Symfony-specific, including bundle registration, service configuration, and typically a Flex recipe. Laravel developers should treat it as protocol documentation rather than a dependency.
- How do I add ALTCHA to Laravel forms without Symfony?
- Use the official altcha-org/altcha PHP server library with a thin Laravel wrapper. Add config/altcha.php for the HMAC secret, algorithm, difficulty, and challenge TTL; an App\Services\Altcha\ChallengeService to issue and verify challenges; and an App\Rules\Altcha validation rule plus a Blade component that wraps the altcha-widget script. This keeps the integration framework-native and avoids Symfony dependencies.
- What is ALTCHA and how does its proof-of-work CAPTCHA work?
- ALTCHA is a privacy-first proof-of-work CAPTCHA. The server issues a signed challenge with salt and SHA-256 proof-of-work parameters, the client solves it, and the server verifies the hash, HMAC signature, and expiry. It avoids third-party tracking, cookies, and image puzzles, but it is a protocol rather than a Laravel feature.
- How does server-side ALTCHA verification work in Laravel?
- The server-side flow is small and framework-agnostic: issue a signed challenge, then verify the returned payload by checking the hash, HMAC signature, and expiry. In Laravel, put that logic in a service class and expose it through a validation rule so it composes with FormRequest validation. The bundle's challenge and verify semantics are portable, but its Symfony plumbing is not.
- Does ALTCHA work without JavaScript, and is it accessible?
- The client side is a Web Component loaded from CDN or npm, so JavaScript is required for the default widget path. Accessibility and no-JS fallback need explicit sign-off against your WCAG and GDPR requirements. Plan a fallback or server-side challenge flow if those constraints apply.
- How do I test ALTCHA validation in Laravel feature tests?
- Because you should build a Laravel wrapper rather than install this bundle, test your own Altcha rule and service. Mock or fake the challenge service in feature tests, assert that valid payloads pass and expired or tampered payloads fail, and avoid calling the CDN in tests. Keep the widget out of the test path and validate server-side behavior directly.
- Is huluti/altcha-bundle safe to add as a Composer dependency?
- Treat the repository metadata as a red flag set. The package name says huluti while the URL points at tito10047, it has about 20 stars and zero dependents, and the last release date should be reconciled against the registry. A single-maintainer package with no downstream consumers is a reference implementation to read, not a Laravel dependency to adopt.
- Are there Laravel-native ALTCHA packages or alternatives?
- There is no reviewed Laravel-native ALTCHA package named in this assessment. The preferred path is the official altcha-org/altcha PHP library with a Laravel wrapper; the fallback is porting the bundle's challenge and verify logic into a service provider without the Symfony wiring. Building in-house takes roughly one to two dev days.
- Does ALTCHA stop targeted bot attacks and form spam?
- ALTCHA raises the cost per request through proof-of-work, which helps with casual form spam but does not stop a determined attacker with cheap compute. Decide whether your threat model is casual spam or targeted automation, and pair ALTCHA with rate limiting and other controls. Proof-of-work is a mitigation, not a complete bot defense.