ReCaptcha Secure Token
This library provides a PHP implementation of the ReCaptcha v2
Secure Token algorithm., (*1)
Usage
You should add this library to your composer require section:, (*2)
"require": {
"slushie/recaptcha-secure-token": "~1.0",
/* ... */
}
From within your PHP code, you can create an instance of the ReCaptchaToken class
and pass in your site_key and site_secret values:, (*3)
$config = ['site_key' => 'YOUR_SITE_KEY', 'site_secret' => 'YOUR_SITE_SECRET'];
$recaptchaToken = new \ReCaptchaSecureToken\ReCaptchaToken($config);
To generate a secure token you must provide a unique session_id:, (*4)
$sessionId = uniqid('recaptcha');
$secureToken = $recaptchaToken->secureToken($sessionId);
Finally, use this token value in your HTML output. For example:, (*5)
<div class="g-recaptcha"
data-sitekey="YOUR_SITE_KEY"
data-stoken="<?php echo $secureToken ?>"></div>
Timestamp
Being a time-based protocol, the timestamp must be accurate. If your system clock is not accurate (try ntpdate), you must pass an accurate timestamp (in ms) to secureToken. You can obtain one from an NTP server, e.g.:, (*6)
$socket = new Bt51\NPM\Socket('0.pool.ntp.org', 123);
$ntp_client = new Bt51\NPM\Client($socket);
$timestamp = $ntp_client->getTime()->getTimestamp() * 1000;
$sessionId = uniqid('recaptcha');
$secureToken = $recaptchaToken->secureToken($sessionId, $timestamp);
Algorithm Implementation
The original ReCaptcha algorithm is undocumented, although
example source code is
provided in Java., (*7)
This implementation is based on the original Java implementation, as well
as some resources from around the web. Of important note are the follow:, (*8)
For more implementation details, please see the source code., (*9)
Security Considerations
There are multiple security flaws in the original implementation. Of particular
note is the use of the ECB block mode, which is known to be insecure. A simple
example of this insecurity is available on
the Wikipedia article on Block cipher modes., (*10)
This could theoretically lead to spammers acquiring your site_secret.
No workaround is provided, the secure token algorithm is inherently insecure., (*11)
License and Copyright
This code is Copyright 2015, Josh Leder. The original Java implementation is
Copyright 2014, Google Inc., (*12)
This code is provided under the Apache 2.0 license., (*13)
Wallogit.com
