A self-hosted Google reCAPTCHA alternative (we ship it)

说明与用途

Altcha 是一种自托管、开源验证码，运行在您自己的域名上，避免将数据发送到美国第三方服务，并消除 GDPR 合规负担。它使用大约一秒钟的工作证明，取代行为指纹识别，提供成本阻止机制。

问题

EU businesses need a captcha that avoids sending data to US third‑party services and complies with GDPR, while still protecting low‑to‑moderate traffic forms from bots.

结果

Altcha reduced client‑side bundle size from 300 KB to 34 KB, eliminated cross‑border data transfers, removed GDPR compliance burden, and provided a one‑second proof‑of‑work challenge that deters low‑to‑moderate traffic bot attacks.

工作流

• Add two endpoints to backend: /api/altcha/challenge and /api/altcha/verify
• Generate HMAC key (openssl rand -hex 32) and store in env variable
• Serve Altcha widget JS from own domain
• Set Cache‑Control: no‑store on challenge endpoint to prevent CDN caching
• Implement replay protection using Redis SETNX with TTL
• Deploy Altcha on existing backend (FastAPI, Django, etc.)
• Test form submission flow and monitor challenge usage

证据

Altcha replaces the "score-the-user" model with a "make-the-bot-pay" model. Proof of work.

来源

The CDN was caching responses from GET /api/altcha/challenge, causing "captcha already used" errors.

来源

Altcha is MIT‑licensed open source. The cost is the CPU spent on the verifying server (negligible) and the client‑side compute (about a second of one core, once per submission).

来源