Weave Code
Recaptcha Bundle Laravel Package
newscoop/recaptcha-bundle
A Symfony bundle that adds Google reCAPTCHA support to Newscoop, helping protect forms and user-facing pages from spam and automated abuse with configurable challenge verification during submissions.
This bundle provides easy reCAPTCHA form field integration, this is a fork of https://github.com/excelwebzone/EWZRecaptchaBundle
Frequently asked questions about Recaptcha Bundle
- Can I install newscoop/recaptcha-bundle in a Laravel application?
- No. It is a Symfony bundle built for the Newscoop CMS, with a Symfony Bundle class, DI extension, and Twig form-theme resources. Laravel has no Bundle bootstrap or kernel registration path for it, so composer require will not give you a usable Laravel integration. The only realistic option is to port the verification logic into your own Laravel validation rule or Blade component.
- Does this package support Laravel 10 or Laravel 11?
- No. The package dates from around 2014 and targets Symfony 2.x and PHP 5.3–5.6 era constraints. Those Composer requirements will not resolve against supported Laravel, Symfony, or PHP versions. Forcing installation with --ignore-platform-reqs yields code that calls APIs removed years ago.
- Which reCAPTCHA version does this bundle use?
- It almost certainly implements the original reCAPTCHA v1 protocol using recaptcha_challenge_field and recaptcha_response_field. That version predates v2 and v3, and Google discontinued the v1 verification endpoint. In practice the server-side check no longer returns a usable success signal.
- How do I add reCAPTCHA to a Laravel form instead of using this bundle?
- Build a small first-party integration: a validation rule that posts the token to Google's siteverify endpoint, a Blade component for the widget, and a config file for site and secret keys sourced from env. Wrap the HTTP call with timeouts and error handling, and test it with Laravel's HTTP fake. This is roughly a one-to-two-day task and avoids carrying dead framework boilerplate.
- Is newscoop/recaptcha-bundle still maintained?
- No. It has around 3 stars and 0 dependents, with no issue triage or security response capacity. The code has been dormant for about a decade and targets framework versions that are long out of support. The upstream excelwebzone/EWZRecaptchaBundle is the maintained-lineage artifact, but it is also legacy.
- What is the difference between newscoop/recaptcha-bundle and excelwebzone/EWZRecaptchaBundle?
- Newscoop/recaptcha-bundle is a Newscoop-specific fork or packaging layer around the original EWZRecaptchaBundle. The upstream bundle is the original Symfony form-type integration; the Newscoop version adds CMS-specific provenance. Neither is a Laravel package, and both target the retired reCAPTCHA v1 era.
- Can I use this bundle with Symfony 5 or Symfony 6?
- No. It relies on Symfony 2.x form and templating conventions, including bundle registration, DI extension wiring, and Twig form themes that have changed or been removed. Dependency resolution will fail before you reach runtime. A migration would mean rewriting the integration against modern Symfony forms and HTTP client APIs.
- How do I validate a reCAPTCHA token server-side in Laravel?
- Send a POST request to Google's siteverify endpoint with your secret key and the submitted token, then check the success flag. For v3, also validate the expected action and a score threshold. Store keys in config/env, use Laravel's HTTP client with timeouts, and fake the endpoint in tests so your suite stays deterministic.
- Is it safe to use a 2014 reCAPTCHA package in production?
- No. The dominant risk is that the underlying reCAPTCHA v1 service is retired, so the package cannot perform its one job. Secondary risks include no community validation, no security response capacity, and Composer constraints that block modern PHP and framework upgrades. Treat it as a design reference only, not a production dependency.
- What should I use for spam protection in Laravel instead of this bundle?
- Use a maintained reCAPTCHA v3 or Enterprise client, or write a thin first-party verifier around Google's JavaScript widget and siteverify API. Pair it with Laravel validation rules, rate limiting, and a honeypot field for defense in depth. Avoid adopting abandoned Symfony 2 bundles for new Laravel work.
Weaver
How can I help you explore Laravel packages today?