- Is webman/captcha a Laravel package or only for the Webman framework?
- It is a Webman plugin, not a Laravel package. It assumes Webman request and response objects, Webman session or cache helpers, and the Webman plugin bootstrap conventions. Laravel teams can study its image-generation approach, but it is not a drop-in Laravel CAPTCHA solution.
- How do I install webman/captcha and add a CAPTCHA route in Webman?
- Install it with Composer as webman/captcha in a Webman project and follow the plugin bootstrap conventions. The package provides a ready-to-use route and helper functions, generates a configurable image, and stores the answer in session. You then validate the submitted user input with a single call.
- Can I use webman/captcha in a Laravel application without rewriting it?
- Not cleanly, because the package is tied to Webman assumptions rather than Laravel contracts. A feasible but non-trivial path is to isolate captcha generation and validation behind a Laravel service or controller and bypass the Webman bootstrap entirely. That adapter risks fighting the package's assumptions about session storage and response emission, so a Laravel-native captcha is usually lower risk.
- How does webman/captcha store and validate CAPTCHA answers?
- It stores the generated answer in session and validates user input through a single verification call. Expiration is adjustable, but the state model is session-oriented rather than explicitly pluggable. If you wrap it for another framework, verify that the adapter does not silently inherit the wrong session or cache semantics.
- Can I customize CAPTCHA length, size, character set, fonts, colors, noise, and background images?
- Yes, the package exposes configurable length, size, and character set options. It also supports custom fonts, colors, background images, and optional noise, lines, and distortion to deter bots. Those options make it suitable for simple forms and login pages when the Webman stack is already in use.
- Is webman/captcha actively maintained and safe for production?
- Version 1.0.5 is a compatibility-only patch that adds PHP 8.4 support and follows the 2025-03-01 release, which is a modest positive maintenance signal. Adoption risk remains high because the package has very low adoption, zero dependents, and single-organization ownership with a likely bus factor of one or two maintainers. CAPTCHA code is security-adjacent, so verify generation entropy, expiration, replay protection, single-use enforcement, and rate-limiting hooks rather than trusting it by default. The provided context does not document a security review or CVE history.
- How does CAPTCHA expiration, single-use enforcement, and replay protection work in webman/captcha?
- The package uses session-based verification with adjustable expiration. The context does not document single-use enforcement, replay protection, or rate-limiting hooks, so those lifecycle details need maintainer confirmation and direct testing. Treat unanswered CAPTCHA lifecycle questions as a production concern before relying on it for authentication forms.
- Which PHP versions does webman/captcha v1.0.5 support, including PHP 8.4?
- Version 1.0.5 explicitly adds PHP 8.4 support and is a no-API-change compatibility patch. Still re-check GD or Imagick availability and Workerman transitive constraints in CI instead of assuming resolution is unchanged. A PHP floor bump in a package can shift dependency resolution outcomes for the whole application.
- How should I test webman/captcha generation and validation in CI?
- Test that image generation returns a valid image response, that the session answer is set, and that validation succeeds for the correct input and fails for incorrect input. Add expiry tests and negative tests for repeated or replayed submissions if those behaviors matter to your flow. If you use an adapter seam, bind a test double or a Laravel-native fallback so CI does not depend on the Webman bootstrap.
- What are the best alternatives to webman/captcha for Laravel projects?
- For a Laravel-only stack, standardize on a Laravel-native CAPTCHA such as mews/captcha or use the underlying gregwar/captcha directly. Those options avoid the coupling and adoption risks of a low-traffic Webman plugin. Treat webman/captcha as a reference implementation unless your roadmap deliberately introduces a Webman or Workerman service.