- Can I use prugala/recaptcha-bundle in a Laravel application?
- Not practically. It is a Symfony bundle built around Symfony's bundle registration, dependency injection container, and YAML/XML configuration, none of which Laravel uses. Making it work would require compatibility shims and a wrapper layer, which is not worth it for a small archived dependency. For Laravel, use a maintained Laravel reCAPTCHA package or a thin internal service that calls Google's siteverify endpoint.
- What is prugala/recaptcha-bundle and what does it do?
- It is a Symfony bundle for integrating Google reCAPTCHA v3 into forms and applications. It provides configuration, server-side validation, and Twig helpers so you can protect endpoints against spam and abuse with minimal setup. Its design targets Symfony's kernel and service container, not Laravel's service providers or package discovery.
- Is prugala/recaptcha-bundle still maintained?
- No. The repository is archived, the last release was in February 2020, and it has very few stars and zero dependents. That means no security response path, no compatibility updates for current PHP or Symfony versions, and no upstream bug fixes. If you adopt it, your team owns all maintenance and upgrades.
- How do I install prugala/recaptcha-bundle?
- It is installed through Composer and then registered as a bundle in a Symfony application, typically in config/bundles.php, followed by bundle configuration and Twig helper usage. There is no Laravel service provider or package auto-discovery, so a Laravel install would not wire anything up automatically. Because the package is archived and predates current framework versions, expect to relax Composer constraints and possibly patch code.
- Does it support reCAPTCHA v2 or only v3?
- It targets reCAPTCHA v3, which is the score-based, invisible variant that returns a token with a score and action name. It is not a drop-in solution for v2 checkbox or invisible challenges. If you need v2, look at other packages or implement the verification call yourself.
- Which Symfony or PHP versions does prugala/recaptcha-bundle support?
- The last release dates from February 2020, so its declared constraints predate current PHP and Symfony versions. Runtime behavior may depend on older Symfony contracts and could break on modern releases. Treat compatibility as unverified and run a time-boxed spike before committing.
- What is a good Laravel alternative to prugala/recaptcha-bundle?
- Use a maintained Laravel-specific reCAPTCHA package, or write a small internal client that posts the token to Google's siteverify endpoint and exposes a Laravel validation rule or service. The verification logic is only a few dozen lines: check success, score, action, and optionally hostname. A native approach avoids Symfony compatibility baggage and keeps you on Laravel's config and HTTP client conventions.
- How would I implement reCAPTCHA v3 in Laravel without this bundle?
- Create a service that sends the front-end token to https://www.google.com/recaptcha/api/siteverify along with your secret key, then inspect the success flag, score, action, and hostname in the response. Wrap that in a custom validation rule so controllers stay clean, and read the secret from config driven by an environment variable. Add logging for low scores so you can tune your threshold over time.
- Is it safe to use an archived package like this in production?
- It carries real risk. An archived dependency has no security response path, no fixes for Google API or framework changes, and low ecosystem validation, so any vulnerability or breakage becomes your responsibility. Given the small functional scope, a maintained package or an internal implementation is usually cheaper than owning a fork.
- How should I test reCAPTCHA v3 integration in Laravel?
- Fake the outbound HTTP call with Laravel's Http::fake so tests never hit Google, and assert your rule rejects low scores, mismatched actions, and failed verification responses. Also test the missing-token and network-error paths, since reCAPTCHA outages should fail in a way you have deliberately chosen, not by accident. Keep the threshold and action names in config so tests can override them.