ReCaptcha Secure Token
This library provides a PHP implementation of the ReCaptcha v2 Secure Token algorithm.
Usage
You should add this library to your composer require
section:
"require": {
"slushie/recaptcha-secure-token": "~1.0",
/* ... */
}
From within your PHP code, you can create an instance of the ReCaptchaToken
class
and pass in your site_key
and site_secret
values:
$config = ['site_key' => 'YOUR_SITE_KEY', 'site_secret' => 'YOUR_SITE_SECRET'];
$recaptchaToken = new \ReCaptchaSecureToken\ReCaptchaToken($config);
To generate a secure token you must provide a unique session_id
:
$sessionId = uniqid('recaptcha');
$secureToken = $recaptchaToken->secureToken($sessionId);
Finally, use this token value in your HTML output. For example:
<div class="g-recaptcha"
data-sitekey="YOUR_SITE_KEY"
data-stoken="<?php echo $secureToken ?>"></div>
Timestamp
Being a time-based protocol, the timestamp must be accurate. If your system clock is not accurate (try ntpdate
), you must pass an accurate timestamp (in ms) to secureToken
. You can obtain one from an NTP server, e.g.:
$socket = new Bt51\NPM\Socket('0.pool.ntp.org', 123);
$ntp_client = new Bt51\NPM\Client($socket);
$timestamp = $ntp_client->getTime()->getTimestamp() * 1000;
$sessionId = uniqid('recaptcha');
$secureToken = $recaptchaToken->secureToken($sessionId, $timestamp);
Algorithm Implementation
The original ReCaptcha algorithm is undocumented, although example source code is provided in Java.
This implementation is based on the original Java implementation, as well as some resources from around the web. Of important note are the follow:
- http://php.net/manual/en/mcrypt.ciphers.php
- http://tools.ietf.org/html/rfc5652#section-6.3
- http://www.networksorcery.com/enp/data/aes.htm
For more implementation details, please see the source code.
Security Considerations
There are multiple security flaws in the original implementation. Of particular
note is the use of the ECB
block mode, which is known to be insecure. A simple
example of this insecurity is available on
the Wikipedia article on Block cipher modes.
This could theoretically lead to spammers acquiring your site_secret
.
No workaround is provided, the secure token algorithm is inherently insecure.
License and Copyright
This code is Copyright 2015, Josh Leder. The original Java implementation is Copyright 2014, Google Inc.
This code is provided under the Apache 2.0 license.