feature request: CAPTCHA support

logto-io / logto

🧑‍🚀 The better identity infrastructure for developers and the open-source alternative to Auth0.

https://logto.io

Mozilla Public License 2.0

8.46k stars 417 forks source link

feature request: CAPTCHA support #1751

Open waltcow opened 2 years ago

waltcow commented 2 years ago

CAPTCHA technology authenticates that a real person is accessing the web content to block spammers and bots that try to automatically harvest email addresses or try to automatically sign up for access to websites, blogs or forums. CAPTCHA blocks automated systems, which can't read the distorted letters in the graphic.

What problem did you meet?

CAPTCHA protection should be added when user perform signIn or signUp

Describe what you'd like Logto to have

default captcha generator in local server
Aliyun Captcha
Geetest
hCaptcha
reCaptcha

gao-sun commented 2 years ago

good call! we'll explore this.

charIeszhao commented 1 year ago

I'm self-assigning this issue and planning to release in Q4.

charIeszhao commented 1 year ago

Per internal discussion this is de-prioritized and further details will be updated later.

johngrimsey commented 3 weeks ago

Any more on this? I have noticed a successful bot signup user email/password connector with verification code enabled.

shamrin commented 1 week ago

Is it possible to implement bot detection / captcha by customizing Logto?

As far as I understand, external captcha JavaScript can be embedded into customized UI. Captcha provider JavaScript would usually produce a token that needs to be verified with them on the backend side.

Is it possible to prevent actions (sign-ins, sign-ups) on Logto backend, based on custom logic? I found custom JWT script feature, is it suitable?