AltchaService.php
ALTCHA proof-of-work captcha service.
Self-hosted, dependency-free implementation of the ALTCHA protocol (https://altcha.org): the server issues a challenge, the browser solves a small SHA-256 proof-of-work, and the server verifies the solution. There is no third-party service and no personal data — it just makes automated mass sign-ups computationally expensive while staying invisible to real users.
The challenge is stateless: an HMAC signature binds it to this server's secret key, so a client cannot forge a challenge (e.g. one with trivial work). Challenges also carry an expiry. Replaying a solved challenge is bounded by the existing auth rate limiter, so no server-side nonce store is needed here.
PHP version 8.1
Tags
Table of Contents
Classes
- AltchaService
- Issues and verifies ALTCHA proof-of-work challenges.