nemunaire/chldapasswd
1
0
Fork 0
Code Issues Pull requests 1 Releases Activity

feat(security): add altcha proof-of-work CAPTCHA to all sensitive forms

Browse source 
Integrate go-altcha to protect login, change password, lost password,
and reset password forms against automated submissions. Serves the
altcha widget JS from the embedded library, exposes a challenge
endpoint, validates responses server-side with replay prevention, and
updates the CSP to allow self-hosted scripts and WebAssembly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
nemunaire 2026-03-06 15:24:59 +07:00
commit 28f55960de
14 changed files with 70 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
static/lost.html
View file

@ -7,6 +7,9 @@
<div class="form-group">
<input name="login" required="" class="form-control" id="input_0" type="text" placeholder="Login" autofocus>
</div>
<div class="form-group">
<altcha-widget challengeurl="altcha-challenge"></altcha-widget>
</div>
<button class="btn btn-primary" type="submit">Reset my password</button>
<a href="/change" class="btn btn-outline-success">Just want to change your password?</a>
</form>