- Can I install mael/recaptcha-bundle in a Laravel app with Composer?
- Not in any usable way. It is a Symfony bundle that relies on Symfony bundle auto-registration, a DependencyInjection Extension and Configuration tree, Twig extensions, and Symfony Form types, none of which exist in Laravel. Composer may resolve the download, but there is no service provider, no config merge, and no validation rule to hook into, so you would get an inert vendor directory. Treat it as a reference implementation rather than a dependency.
- Does mael/recaptcha-bundle support reCAPTCHA v3 scores and actions?
- Almost certainly not. The last release was 2020-05-23, which predates widespread v3 adoption patterns, and the bundle is shaped around v2 checkbox and invisible flows. There is no evidence of score thresholds, action verification, render=/onload= parameters, or Enterprise support. If you need v3 you should verify the source yourself or use a maintained Laravel package.
- What Laravel package should I use instead of mael/recaptcha-bundle?
- Use a maintained Laravel-native option such as biscolab/laravel-recaptcha, anhskohbo/no-captcha, or google/recaptcha as a thin SDK with your own validation rule. These give you Laravel config, Blade rendering, validation rules, and active maintenance. The Symfony bundle gives you none of that and would need a fork you own.
- How do I verify a reCAPTCHA token server-side in Laravel?
- Post the g-recaptcha-response token along with your secret key to Google's siteverify endpoint using the HTTP client, then validate the response. Check success, and also hostname, challenge_ts, action, and score where relevant, because checking success alone is a known bypass pattern. Wrap it in a Laravel validation Rule so it composes with FormRequest validation, and read keys from config/services.php backed by .env.
- Is mael/recaptcha-bundle still maintained and PHP 8.2 compatible?
- It is effectively abandoned: last release 2020-05-23, 2 stars, 0 dependents, and a single maintainer in a personal namespace. There is no evidence of PHP 8.2 or 8.3 fixes or Symfony 6/7 support, and the 2020 version matrix likely targets PHP 7.x and Symfony 4/5. Even in a Symfony app you must verify compatibility and Guzzle version constraints before counting on it.
- How are the site and secret keys configured in mael/recaptcha-bundle?
- Conventionally through the Symfony bundle's YAML configuration tree, which the DependencyInjection Extension merges into the container. That pattern works in Symfony but has no equivalent in Laravel, and copying it verbatim risks committing secrets into config files. In Laravel you should use .env plus config/services.php so keys never land in version control.
- Is it safe to use mael/recaptcha-bundle in production?
- I would not. Provenance signals are poor, with five-year staleness, no adoption, one maintainer, and no visible SECURITY.md or disclosure process, and the source has not been reviewed for TLS enforcement, timeouts, or full siteverify field validation. The integration risk is high relative to the tiny amount of code being replaced. A 60 to 120 line in-house implementation plus a Blade component is cheaper and fully owned.
- How do I test reCAPTCHA in Laravel without calling Google?
- Fake the HTTP client and assert your validation rule sends the expected secret, response token, and remote IP, then assert behaviour for success, failure, low score, and action mismatch. Google publishes test keys that always pass or always fail, which are useful for end-to-end checks in staging. Keep the verification behind an interface so tests can bind a stub.
- Should I fork mael/recaptcha-bundle for Laravel?
- No, because forking costs more than rewriting. A port means replacing YAML config with config/services.php and .env, Twig functions with a Blade component or directive, Symfony Form types with a Laravel validation Rule, and the bundle's wiring with Http or Guzzle. That is a fork you must maintain forever to save a few hours of design. Use it as a design reference only.
- How much code does a native Laravel reCAPTCHA integration take?
- Roughly 60 to 120 lines of PHP plus a small Blade component. That covers rendering the widget, carrying the token, POSTing to siteverify, and validating success, hostname, challenge_ts, action, and score. It is small, well understood, and gives you full ownership with no abandoned dependency. A one-day spike is a realistic estimate.