A self-hosted Google reCAPTCHA alternative (we ship it)

Описание и применение

Altcha – самодостаточный, открытый captcha, который работает на собственном домене, не отправляет данные в США и не требует GDPR‑соответствия. Он использует доказательство работы, которое занимает ~1 секунду, и устраняет необходимость в сторонних сервисах, таких как Google reCAPTCHA.

Задача

EU businesses need a captcha that avoids sending data to US third‑party services and complies with GDPR, while still protecting low‑to‑moderate traffic forms from bots.

Результат

Altcha reduced client‑side bundle size from 300 KB to 34 KB, eliminated cross‑border data transfers, removed GDPR compliance burden, and provided a one‑second proof‑of‑work challenge that deters low‑to‑moderate traffic bot attacks.

Рабочий процесс

• Add two endpoints to backend: /api/altcha/challenge and /api/altcha/verify
• Generate HMAC key (openssl rand -hex 32) and store in env variable
• Serve Altcha widget JS from own domain
• Set Cache‑Control: no‑store on challenge endpoint to prevent CDN caching
• Implement replay protection using Redis SETNX with TTL
• Deploy Altcha on existing backend (FastAPI, Django, etc.)
• Test form submission flow and monitor challenge usage

Доказательства

Altcha replaces the "score-the-user" model with a "make-the-bot-pay" model. Proof of work.

Источник

The CDN was caching responses from GET /api/altcha/challenge, causing "captcha already used" errors.

Источник

Altcha is MIT‑licensed open source. The cost is the CPU spent on the verifying server (negligible) and the client‑side compute (about a second of one core, once per submission).

Источник