Weave Code
Google Recaptcha Bundle Laravel Package
kleegroup/google-recaptcha-bundle
KleeGroup Google reCAPTCHA Bundle integrates Google reCAPTCHA with Symfony applications, offering form integration, configurable site and secret keys, and server-side verification of submitted responses to help protect forms from spam and abuse.
Symfony bundle for Google ReCaptcha
Frequently asked questions about Google Recaptcha Bundle
- Is kleegroup/google-recaptcha-bundle a Laravel package?
- No. It is a Symfony bundle that registers through a Symfony kernel and ships DependencyInjection extensions, form types, and validator constraints. Laravel has no equivalent bundle extension point, so it cannot be installed and registered as a Laravel package. The Composer name is misleading if you are searching Packagist for Laravel reCAPTCHA options.
- Can I install this Symfony reCAPTCHA bundle in a Laravel application?
- Composer may resolve it, but Laravel does not ship symfony/framework-bundle, so there is no kernel to compile or register the bundle. You would have to boot a full Symfony kernel inside Laravel just to make one HTTP verification call. It also drags in a large unrelated dependency tree and adds constraint pressure on future Laravel and PHP upgrades.
- Which reCAPTCHA versions does the bundle support?
- It supports reCAPTCHA v2 (checkbox and invisible) and v3 score-based verification, with configurable keys, score thresholds, and action settings exposed through bundle configuration. Twig helpers render the widget and badge. That describes the Symfony implementation only; in Laravel you would need to reproduce the same behavior yourself.
- Is kleegroup/google-recaptcha-bundle still maintained?
- No. The last release was on 30 November 2018, roughly seven years without a commit or CVE response. It has around six GitHub stars and zero dependents, so there is no downstream ecosystem to inherit patches or bug reports from. Treat it as an archived reference implementation rather than a dependency.
- Does it work with PHP 8.2 or PHP 8.4?
- There is no compatibility statement covering PHP 8.x. Its Composer constraints are era-locked to Symfony 3.x/4.x component ranges and PHP 7.x, so expect conflicts or deprecation noise on modern runtimes. Assume it fails or needs patches before running on PHP 8.2 and above.
- How do I verify a reCAPTCHA token in Laravel instead?
- Write a RecaptchaRule implementing Illuminate\Contracts\Validation\ValidationRule that posts secret, response, and remoteip to https://www.google.com/recaptcha/api/siteverify through Http::asForm(). Inspect the success flag plus score and action for v3, and return a clear failure message when the check does not pass. Keep the HTTP call behind a small RecaptchaVerifier service so it can be swapped or faked in tests. The whole implementation is roughly 150 lines plus tests.
- Where should I store reCAPTCHA site and secret keys in Laravel?
- Put them in config/services.php as recaptcha.site_key and recaptcha.secret, populated from RECAPTCHA_SITE_KEY and RECAPTCHA_SECRET environment variables. Never hardcode the secret key, and avoid per-form injection unless you genuinely run a multi-tenant setup. Add an env-driven enabled flag so local and CI environments can skip verification.
- How do I test reCAPTCHA validation in Laravel feature tests?
- Bind a fake RecaptchaVerifier into the container during test setup and have it return a successful or failed result. That keeps tests offline and deterministic without hitting Google's siteverify endpoint. Also cover the failure path so you confirm the validation rule surfaces the right error message.
- Does server-side verification check score, action, and hostname, or only success?
- The bundle verifies submitted responses against Google's siteverify API server-side, but you must read the code to confirm whether it inspects score, action, apikey, and hostname or only the success flag. Most subtly wrong implementations check success alone and skip action matching. If you port the behavior to Laravel, validate the action string and enforce a score threshold explicitly.
- What are the alternatives for Laravel reCAPTCHA protection?
- Pick a currently maintained Laravel reCAPTCHA package with recent releases, or implement the validation rule yourself and own the code. Google is steering new adopters to reCAPTCHA Enterprise, which offers first-party SDK support and stronger bot scoring. Decide between v2, v3, and Enterprise before writing code, since the choice changes both the UX and the data you store.
Weaver
How can I help you explore Laravel packages today?