TypeScript API / @laikacms/server/oauth2 / CaptchaConfig

Interface: CaptchaConfig

Generic CAPTCHA configuration. Supports any CAPTCHA provider (reCAPTCHA, hCaptcha, Cloudflare Turnstile, etc.) by allowing custom HTML/scripts and a verification callback.

Properties

captchaCspAdditions?

optional captchaCspAdditions?: string;

Additional CSP directives to allow the CAPTCHA provider's scripts and widgets. Appended to script-src 'unsafe-inline' and may include extra directives such as frame-src.

Applied on both the login page and the forgot-password page.

Examples:

• Cloudflare Turnstile: ' https://challenges.cloudflare.com; frame-src https://challenges.cloudflare.com'
• reCAPTCHA v2: ' https://www.google.com https://www.gstatic.com; frame-src https://www.google.com'
• hCaptcha: ' https://js.hcaptcha.com https://newassets.hcaptcha.com; frame-src https://newassets.hcaptcha.com'

If omitted, no external origins are added to the CSP (only 'unsafe-inline' is kept).

---

enabled

enabled: boolean;

Enable CAPTCHA on login and forgot password forms

---

responseFieldName

responseFieldName: string;

Name of the form field that contains the CAPTCHA response token. Default field names by provider:

• reCAPTCHA: 'g-recaptcha-response'
• hCaptcha: 'h-captcha-response'
• Turnstile: 'cf-turnstile-response'

---

scriptHtml

scriptHtml: string;

Script tag(s) to load the CAPTCHA library. This is inserted in the <head> section.

Examples:

• reCAPTCHA: <script src="https://www.google.com/recaptcha/api.js" async defer></script>
• hCaptcha: <script src="https://js.hcaptcha.com/1/api.js" async defer></script>
• Turnstile: <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

---

widgetHtml

widgetHtml: string;

HTML to render the CAPTCHA widget in the form. This is inserted before the submit button.

Examples:

• reCAPTCHA v2: <div class="g-recaptcha" data-sitekey="YOUR_SITE_KEY"></div>
• hCaptcha: <div class="h-captcha" data-sitekey="YOUR_SITE_KEY"></div>
• Turnstile: <div class="cf-turnstile" data-sitekey="YOUR_SITE_KEY"></div>

Methods

verify()

verify(token, remoteIp?): Promise<boolean>;

Verify the CAPTCHA response token. This callback should call your CAPTCHA provider's verification API.

Parameters

Parameter	Type	Description
token	string	The CAPTCHA response token from the form submission
remoteIp?	string	The client's IP address (optional, some providers require this)

Returns

Promise<boolean>

Promise resolving to true if verification passed, false otherwise

Example implementation for Cloudflare Turnstile:

async verify(token, remoteIp) {
  const response = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
      secret: TURNSTILE_SECRET_KEY,
      response: token,
      remoteip: remoteIp || '',
    }),
  });
  const result = await response.json();
  return result.success === true;
}