From 51705056a578d2649a989bf14a056fbcfae58a6b Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Wed, 14 Oct 2026 13:34:47 +0200 Subject: feat(hub): replace reCAPTCHA with a self-hosted proof of work Sign-up and passphrase reset sent every visitor's address and browser details to Google, which needed a consent the sign-up form could not ask for freely. The hub now issues its own challenge (ALTCHA's scheme, signed with a key derived from the hub's private key, single-use, 30 minutes) and the page solves it with SubtleCrypto while the form is filled in. - GET /v1/users/captcha issues a challenge; 404 captcha_disabled when off. - [captcha] enabled / max_number replace site_key / secret_key, which are now ignored with a warning; MESHBAY_CAPTCHA_ENABLED replaces the old variables. - No Google origin left in the CSP of the hub, the desktop shell or the Android shell; captcha_site_key leaves /v1/hub/info. Co-Authored-By: Claude Opus 5.5 --- docs/MESHBAY_HTTP_API.md | 1 + 1 file changed, 1 insertion(+) (limited to 'docs/MESHBAY_HTTP_API.md') diff --git a/docs/MESHBAY_HTTP_API.md b/docs/MESHBAY_HTTP_API.md index 73d079d..be4e7e2 100644 --- a/docs/MESHBAY_HTTP_API.md +++ b/docs/MESHBAY_HTTP_API.md @@ -40,6 +40,7 @@ hub also serves the web application at `/` and `/app/`, which are not listed. | Method | Path | Auth | What | |---|---|---|---| +| GET | `/v1/users/captcha` | none | A proof-of-work challenge for the register and reset-request forms. | | POST | `/v1/users/register` | none | Create an account. | | POST | `/v1/users/verify-email` | none | Verify a registration email with the code received by mail. | | POST | `/v1/users/me/bundle-pepper` | user | The pepper, for a session that has just been given the passphrase again. | -- cgit v1.2.3