Git Product home page Git Product logo

captcha's Introduction

Package captcha

⚠️ Warning: this captcha can be broken by advanced OCR captcha breaking algorithms.

import "github.com/dchest/captcha"

Package captcha implements generation and verification of image and audio CAPTCHAs.

A captcha solution is the sequence of digits 0-9 with the defined length. There are two captcha representations: image and audio.

An image representation is a PNG-encoded image with the solution printed on it in such a way that makes it hard for computers to solve it using OCR.

An audio representation is a WAVE-encoded (8 kHz unsigned 8-bit) sound with the spoken solution (currently in English, Russian, Chinese, and Japanese). To make it hard for computers to solve audio captcha, the voice that pronounces numbers has random speed and pitch, and there is a randomly generated background noise mixed into the sound.

This package doesn't require external files or libraries to generate captcha representations; it is self-contained.

To make captchas one-time, the package includes a memory storage that stores captcha ids, their solutions, and expiration time. Used captchas are removed from the store immediately after calling Verify or VerifyString, while unused captchas (user loaded a page with captcha, but didn't submit the form) are collected automatically after the predefined expiration time. Developers can also provide custom store (for example, which saves captcha ids and solutions in database) by implementing Store interface and registering the object with SetCustomStore.

Captchas are created by calling New, which returns the captcha id. Their representations, though, are created on-the-fly by calling WriteImage or WriteAudio functions. Created representations are not stored anywhere, but subsequent calls to these functions with the same id will write the same captcha solution. Reload function will create a new different solution for the provided captcha, allowing users to "reload" captcha if they can't solve the displayed one without reloading the whole page. Verify and VerifyString are used to verify that the given solution is the right one for the given captcha id.

Server provides an http.Handler which can serve image and audio representations of captchas automatically from the URL. It can also be used to reload captchas. Refer to Server function documentation for details, or take a look at the example in "capexample" subdirectory.

Examples

Image

Audio

Constants

const (
    // Default number of digits in captcha solution.
    DefaultLen = 6
    // The number of captchas created that triggers garbage collection used
    // by default store.
    CollectNum = 100
    // Expiration time of captchas used by default store.
    Expiration = 10 * time.Minute
)
const (
    // Standard width and height of a captcha image.
    StdWidth  = 240
    StdHeight = 80
)

Variables

var (
    ErrNotFound = errors.New("captcha: id not found")
)

Functions

func New

func New() string

New creates a new captcha with the standard length, saves it in the internal storage and returns its id.

func NewLen

func NewLen(length int) (id string)

NewLen is just like New, but accepts length of a captcha solution as the argument.

func RandomDigits

func RandomDigits(length int) (b []byte)

RandomDigits returns a byte slice of the given length containing pseudorandom numbers in range 0-9. The slice can be used as a captcha solution.

func Reload

func Reload(id string) bool

Reload generates and remembers new digits for the given captcha id. This function returns false if there is no captcha with the given id.

After calling this function, the image or audio presented to a user must be refreshed to show the new captcha representation (WriteImage and WriteAudio will write the new one).

func Server

func Server(imgWidth, imgHeight int) http.Handler

Server returns a handler that serves HTTP requests with image or audio representations of captchas. Image dimensions are accepted as arguments. The server decides which captcha to serve based on the last URL path component: file name part must contain a captcha id, file extension — its format (PNG or WAV).

For example, for file name "LBm5vMjHDtdUfaWYXiQX.png" it serves an image captcha with id "LBm5vMjHDtdUfaWYXiQX", and for "LBm5vMjHDtdUfaWYXiQX.wav" it serves the same captcha in audio format.

To serve a captcha as a downloadable file, the URL must be constructed in such a way as if the file to serve is in the "download" subdirectory: "/download/LBm5vMjHDtdUfaWYXiQX.wav".

To reload captcha (get a different solution for the same captcha id), append "?reload=x" to URL, where x may be anything (for example, current time or a random number to make browsers refetch an image instead of loading it from cache).

By default, the Server serves audio in English language. To serve audio captcha in one of the other supported languages, append "lang" value, for example, "?lang=ru".

func SetCustomStore

func SetCustomStore(s Store)

SetCustomStore sets custom storage for captchas, replacing the default memory store. This function must be called before generating any captchas.

func Verify

func Verify(id string, digits []byte) bool

Verify returns true if the given digits are the ones that were used to create the given captcha id.

The function deletes the captcha with the given id from the internal storage, so that the same captcha can't be verified anymore.

func VerifyString

func VerifyString(id string, digits string) bool

VerifyString is like Verify, but accepts a string of digits. It removes spaces and commas from the string, but any other characters, apart from digits and listed above, will cause the function to return false.

func WriteAudio

func WriteAudio(w io.Writer, id string, lang string) error

WriteAudio writes WAV-encoded audio representation of the captcha with the given id and the given language. If there are no sounds for the given language, English is used.

func WriteImage

func WriteImage(w io.Writer, id string, width, height int) error

WriteImage writes PNG-encoded image representation of the captcha with the given id. The image will have the given width and height.

Types

type Audio struct {
    // contains unexported fields
}

func NewAudio

func NewAudio(id string, digits []byte, lang string) *Audio

NewAudio returns a new audio captcha with the given digits, where each digit must be in range 0-9. Digits are pronounced in the given language. If there are no sounds for the given language, English is used.

Possible values for lang are "en", "ja", "ru", "zh".

func (*Audio) EncodedLen

func (a *Audio) EncodedLen() int

EncodedLen returns the length of WAV-encoded audio captcha.

func (*Audio) WriteTo

func (a *Audio) WriteTo(w io.Writer) (n int64, err error)

WriteTo writes captcha audio in WAVE format into the given io.Writer, and returns the number of bytes written and an error if any.

type Image struct {
    *image.Paletted
    // contains unexported fields
}

func NewImage

func NewImage(id string, digits []byte, width, height int) *Image

NewImage returns a new captcha image of the given width and height with the given digits, where each digit must be in range 0-9.

func (*Image) WriteTo

func (m *Image) WriteTo(w io.Writer) (int64, error)

WriteTo writes captcha image in PNG format into the given writer.

type Store interface {
    // Set sets the digits for the captcha id.
    Set(id string, digits []byte)

    // Get returns stored digits for the captcha id. Clear indicates
    // whether the captcha must be deleted from the store.
    Get(id string, clear bool) (digits []byte)
}

An object implementing Store interface can be registered with SetCustomStore function to handle storage and retrieval of captcha ids and solutions for them, replacing the default memory store.

It is the responsibility of an object to delete expired and used captchas when necessary (for example, the default memory store collects them in Set method after the certain amount of captchas has been stored.)

func NewMemoryStore

func NewMemoryStore(collectNum int, expiration time.Duration) Store

NewMemoryStore returns a new standard memory store for captchas with the given collection threshold and expiration time in seconds. The returned store must be registered with SetCustomStore to replace the default one.

captcha's People

Contributors

dchest avatar ebfe avatar icyux avatar rainyear avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

captcha's Issues

how to use captcha in echo

I use the code as below but the url localhost:port/captcha/ is not found :

e := echo.New()

e.GET("/captcha/", echo.WrapHandler(captcha.Server(captcha.StdWidth, captcha.StdHeight)))

please help me

How can i use captcha in Gin Framework?

	if err := formTemplate.Execute(w, &d); err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
	}

i think formTemplate.Execute is the keyword to generate a captch. But i use gin with gin multemplate.

How can i use captcha in Gin framework?

image.go make func encodedPNG() to EncodedPNG()

in image.go
make func encodedPNG() []byte to EncodedPNG() []byte,
it can support other http framework like "iris" "gin" !!!

and
1.
I recommend separate storage interfaces and image generator ,and delete storage interface,
For example,
com.google.code.kaptcha,
it only do the createText(),createImage().
other job like storage, i will choose like "redis" "mysql" "mongo"....

do not use "Id",and do not use "captcha.VerifyString(id string, digits string)" ,
I think the id just like session,but some people like me will use phone to Instead of id,and use
custom validation

set store is't work

func init() {
captcha.SetCustomStore(captcha.NewMemoryStore(100,5*time.Minute))
}

is't work ! why?

problem in julienschmidt router

hi
I've been trying to modify your example to use julienschmidt routing but keep coming up with a 404 error when accessing /captcha/

instead of your code in default http route i have used this code
r.Handler(http.MethodGet,"/captcha/" ,captcha.Server(captcha.StdWidth, captcha.StdHeight))
but still i do not access to "captcha" directory and .png file too.
how could i use your library with julienschmidt http routing?

Set background color

Hi everybody,

I was wondering how one can change background color to something other than transparent.

Using AJAX

I am trying to implement the captcha with AJAX. Currently when a user submits just digits(runs through the Verify function in captcha.go) the captcha image becomes broken. This occurs regardless if the Reload button is triggered through JavaScript. Implementing strings or strings with digits however allows reload of image but the captcha image breaks again when only digits are entered using AJAX.

I think this is mainly because the entire web page needs to be parsed again and pass in the captcha.New() string through go templates.

So I don't see any way to combine AJAX with this set up as if I have to refresh the entire web page to pass in the captchaId string through golang templates then using AJAX would be pointless. Any ideas to work around this?

Captcha in letters

Please provide captcha for letters too, instead only for digits.

Thanks so much.

Jigsaw captcha

Would be cool to add the jigsaw puzzle captcha .

apparently it’s a good security option and hard to OCR defeat but curious what others think about it’s merit .

too difficult to recognize audio captcha

Hi, I found it really hard to recognize numbers (particularly, 0 1 5) from background noise when trying audio captcha in Chinese, even with earphone.

I'm a native listener, and I think most Chinese users would have the same feeling as me. As for me, passing the default audio captcha within 10 attempts is nearly impossible.

Could you please consider it, to replace the hard-to-recognize voices? What's more, it is reasonable to allow developers to adjust the difficulty (for example, noise intensity). Thanks.

Security issue: Can't set custom security headers

We can setup a captcha server by using:
http.Handle("/captcha/", captcha.Server(captcha.StdWidth, captcha.StdHeight)

However, this does not allow setting custom headers for enhancing security such as:

Access-Control-Allow-Origin
X-Frame-Options
X-Content-Type-Options
X-XSS-Protection

This leaves the application vulnerable to various attacks

Too difficult to recognize the number

great work!
But numbers stay too close and sometimes overlap.
Do you have an image size / ratio recommendation or design an param to set the difficulty?

Distinguish between expired captchas and invalid submissions?

It seems that there is no way to do this, though it would be helpful. I'd like to alert my users with "expired captcha" or "invalid captcha" instead of just reporting failure.

This is pretty minor, of course. By and large, this is a great package. Thanks for building and sharing. You've saved me quite a bit of effort/frustration/etc.

Make Server accept a config struct

Currently, Server, accepts imgWidth and imgHeight. I'd like to change it to accept a configuration struct to make it easier to expand it without API change:

type ServerConfig struct {
   ImgWidth  int
   ImgHeight int
}

func Server(config *ServerConfig) http.Handler

Another idea is to make top-level functions methods on config (renamed Server or something):

type Server struct {
   ImgWidth     int
   ImgHeight    int
   Store        Store
   CollectNum   int
   Expiration   time.Time
}

func (c *Server) Handler() http.Handler

provide `New() (id , solution string)`

Hi,

I am in a case where i want the api to give both id and solution when invoking its service.

Some explanations, I need that while using captcha within a JSON API. Currently i only send back an id, with these new api i will be able to cipher the solution using a private key, and signing the message, which i will answer along the id. Using that i can validate any captcha issued by my api even though the service was restarted (i use no persistent db for captcha service), or, worst case, the api has totally changed because i only need to check the signed message, uncipher the solution and compare it with the JIT provided solution.

Add Letters

How can I add letters to drawing? it is just digits and does't provide enough security

Func VerifyString it works incorrectly

I was advised by a colleague to use this repository, as he was able to implement protection.
When I started testing I ran into a problem -- verify and verifystring display false all the time.

code:

func main() {
	id := captcha.New()
	path_img, _ := os.Create("data.png")

	var w io.WriterTo
	digits := captcha.RandomDigits(6)
	w = captcha.NewImage(id, digits, 256, 128)
	w.WriteTo(path_img)

	var x string
	fmt.Scan(&x)
	fmt.Println(
		"result: ", captcha.VerifyString(id, x), 
		"\ngenerate digits:", digits, 
		"\nid:", id,
	)
}

result from console:
image

Captcha as a Service

Could you make dchest/captcha as a standalone service? and provide http API for web app? and pack it as a ubuntu service?

Prevent replay attacks

After successful verification, delete the cached verification code to prevent replay attacks.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.