Dokumentation

<!-- In deinem HTML, vor </body> -->
<script src="https://src-eu.captchacore.eu/widget/captchacore-v2.min.js"
        data-service-url="https://api.captchacore.eu"
        data-site-key="cc_pub_DEIN_KEY"
        async defer></script>

<!-- Formular mit CaptchaCore -->
<form data-captchacore="interactive" method="post">
    <!-- Deine Formularfelder -->
    <div data-captchacore-widget></div>
    <button type="submit">Absenden</button>
</form>

{
    "repositories": [
        {
            "type": "composer",
            "url": "https://captchacore.eu/packages"
        }
    ]
}

composer require captchacore/laravel

CAPTCHACORE_URL=https://captchacore.eu
CAPTCHACORE_SITE_KEY=cc_pub_dein_key
CAPTCHACORE_SECRET_KEY=cc_sec_dein_secret
CAPTCHACORE_WIDGET_MODE=interactive  # interactive | visible | invisible
CAPTCHACORE_WIDGET_THEME=auto        # auto | light | dark
CAPTCHACORE_WIDGET_COLOR=#4ade80
CAPTCHACORE_WIDGET_LABEL=Ich bin kein Bot
CAPTCHACORE_WIDGET_BRAND=CaptchaCore

<form method="post" data-captchacore="interactive">
    @csrf
    <!-- Formularfelder -->
    <x-captchacore::widget />
    <button type="submit">Absenden</button>
</form>

// Route schützen
Route::post('/register', RegisterController::class)
    ->middleware('captchacore:register');

// Oder als Validation Rule
'captchacore_token' => ['required', new CaptchaCoreToken('contact')]

// Tests: fake() mockt alle Verifikationen
CaptchaCore::fake();

composer require captchacore/captchacore-bundle

CAPTCHACORE_URL=https://api.captchacore.eu
CAPTCHACORE_SITE_KEY=cc_pub_xxxxxxxxxxxxxxxxxxxxxxxxxxxx
CAPTCHACORE_SECRET_KEY=cc_sec_xxxxxxxxxxxxxxxxxxxxxxxxxxxx

use CaptchaCore\SymfonyBundle\Form\Type\CaptchaCoreType;

$builder
    ->add('email', EmailType::class)
    ->add('message', TextareaType::class)
    ->add('captcha', CaptchaCoreType::class, [
        'form_type' => 'contact',
    ]);

use CaptchaCore\SymfonyBundle\Security\Attribute\RequiresCaptcha;

#[Route('/contact', methods: ['POST'])]
#[RequiresCaptcha(formType: 'contact')]
public function submit(Request $request): Response { /* ... */ }

use CaptchaCore\SymfonyBundle\Validator\CaptchaCoreToken;

final class ContactDto {
    public function __construct(
        #[Assert\NotBlank]
        public string $email,

        #[CaptchaCoreToken(formType: 'contact')]
        public string $captchaToken,
    ) {}
}

use CaptchaCore\SymfonyBundle\Client\CaptchaCoreClient;

$result = $this->captcha->verify($token, 'login');

if ($result->blocked()) {
    throw new AccessDeniedHttpException();
}

// Properties: valid, riskScore, action, confidence, reasons, stepUp

{{ captchacore_widget(mode: 'interactive') }}

env_automation_globals: +90   Selenium/Puppeteer/CDP Leak im window-Objekt
env_ua_brand_bot:       +80   UA Client Hints verraten Automation-Framework
env_software_renderer:  +50   WebGL nutzt SwiftShader/llvmpipe = headless
env_canvas_too_fast:    +40   Canvas-Render < 2ms = headless (Mensch: 5-50ms)
env_no_storage:         +30   localStorage UND indexedDB fehlen
env_raf_robotic:        +25   requestAnimationFrame perfekt uniform (CV < 0.05)
env_no_webgl_ext:       +25   0 WebGL-Extensions auf Desktop = headless
header_no_sec_fetch:    +25   Sec-Fetch-* Header fehlen = altes/scripted Client
header_no_accept_lang:  +20   Accept-Language fehlt = scripted
env_no_hover:           +5    Hover nicht unterstützt (selten valide auf Desktop)
env_audio_hash_missing: +5    OfflineAudioContext blockiert (Privacy-Browser ok)

1. Globale Defaults     (config: allow<30, challenge<60)
2. Site-Profil           (z.B. "Auth Hardened" → allow<20, challenge<50)
3. Form-Policy           (z.B. login → allow<15, fail_closed)

<!-- Widget: form_type als data-Attribut -->
<form data-captchacore="interactive" data-form-type="login">
    <div data-captchacore-widget data-form-type="login"></div>
</form>

// Verify-Request: form_type im Body
POST /api/v2/verify
{
    "token":     "...",
    "form_type": "login"   // Steuert welche Policy angewendet wird
}

cc_pub_6e65b5c4597a688c93f3be6e345ee1a5...  ← 7 + 64 hex = 71 Zeichen
cc_sec_8bb043aa6424a1fdb3e048d2d3232894...  ← 7 + 64 hex = 71 Zeichen

$token = $_POST['captchacore_token'] ?? '';

$ch = curl_init('https://api.captchacore.eu/api/v2/verify');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT        => 3,
    CURLOPT_HTTPHEADER     => [
        'X-CaptchaCore-Key: cc_sec_DEIN_SECRET',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'token'     => $token,
        'form_type' => 'contact',
    ]),
]);
$result = json_decode(curl_exec($ch), true);

if (!$result['valid']) {
    die('Bot erkannt.');
}

const token = req.body.captchacore_token;

const res = await fetch('https://api.captchacore.eu/api/v2/verify', {
  method: 'POST',
  headers: {
    'X-CaptchaCore-Key': process.env.CAPTCHACORE_SECRET_KEY,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({ token, form_type: 'register' }),
});
const { valid, risk_score, action } = await res.json();

if (!valid) return res.status(403).json({ error: 'Bot detected' });

# Minimal (EU-only CDN + API)
script-src  https://src-eu.captchacore.eu;
connect-src https://api.captchacore.eu https://src-eu.captchacore.eu;
worker-src  blob:;

# Mit globalem CDN (zusätzlich)
script-src  https://src.captchacore.eu;
connect-src https://src.captchacore.eu;

Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: Content-Type, Accept, X-CaptchaCore-Key

# NGINX — CSP für CaptchaCore Widget
add_header Content-Security-Policy
  "script-src 'self' https://src-eu.captchacore.eu;
   connect-src 'self' https://api.captchacore.eu https://src-eu.captchacore.eu;
   worker-src 'self' blob:;"