Captcha providers

Captcha providers protect sensitive endpoints from automated abuse. rCTF supports three captcha services.

Configuration#

Captcha configuration has two parts: the provider (which service to use) and the protected endpoints (which actions require verification).

captcha:
  provider:
    name: captcha/turnstile
    options:
      siteKey: your-site-key
      secretKey: your-secret-key
  protectedEndpoints:
    - register
    - recover

Protected endpoints#

The protectedEndpoints array controls which actions require captcha verification:

Action	Description
`register`	New account registration
`recover`	Account recovery via email
`setEmail`	Changing account email
`instancerStart`	Starting a challenge instance
`instancerExtend`	Extending a challenge instance lifetime
`avatarUpload`	Uploading a team avatar
`adminBotSubmit`	Submitting a job to the admin bot

Only the actions listed in protectedEndpoints will require captcha. Unlisted actions proceed without verification.

Providers#

Google reCAPTCHA v2 Invisible. The frontend renders the widget with size: 'invisible' and verifies the response against https://www.google.com/recaptcha/api/siteverify.

captcha:
  provider:
    name: captcha/recaptcha
    options:
      siteKey: your-site-key
      secretKey: your-secret-key

Option	Environment Variable	Description
`siteKey`	`RCTF_RECAPTCHA_SITE_KEY`	reCAPTCHA site key
`secretKey`	`RCTF_RECAPTCHA_SECRET_KEY`	reCAPTCHA secret key

hCaptcha verification.

captcha:
  provider:
    name: captcha/hcaptcha
    options:
      siteKey: your-site-key
      secretKey: your-secret-key

Option	Environment Variable	Description
`siteKey`	`RCTF_HCAPTCHA_SITE_KEY`	hCaptcha site key
`secretKey`	`RCTF_HCAPTCHA_SECRET_KEY`	hCaptcha secret key

Cloudflare Turnstile verification.

captcha:
  provider:
    name: captcha/turnstile
    options:
      siteKey: your-site-key
      secretKey: your-secret-key

Option	Environment Variable	Description
`siteKey`	`RCTF_TURNSTILE_SITE_KEY`	Turnstile site key
`secretKey`	`RCTF_TURNSTILE_SECRET_KEY`	Turnstile secret key

Migrating from v1#

If you are using the legacy recaptcha top-level config from v1, it is automatically converted to the new format at startup. However, migrating is recommended:

recaptcha:
  siteKey: your-site-key
  secretKey: your-secret-key
  protectedActions:
    - register

captcha:
  provider:
    name: captcha/recaptcha
    options:
      siteKey: your-site-key
      secretKey: your-secret-key
  protectedEndpoints:
    - register