From 51705056a578d2649a989bf14a056fbcfae58a6b Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Wed, 14 Oct 2026 13:34:47 +0200 Subject: feat(hub): replace reCAPTCHA with a self-hosted proof of work Sign-up and passphrase reset sent every visitor's address and browser details to Google, which needed a consent the sign-up form could not ask for freely. The hub now issues its own challenge (ALTCHA's scheme, signed with a key derived from the hub's private key, single-use, 30 minutes) and the page solves it with SubtleCrypto while the form is filled in. - GET /v1/users/captcha issues a challenge; 404 captcha_disabled when off. - [captcha] enabled / max_number replace site_key / secret_key, which are now ignored with a warning; MESHBAY_CAPTCHA_ENABLED replaces the old variables. - No Google origin left in the CSP of the hub, the desktop shell or the Android shell; captcha_site_key leaves /v1/hub/info. Co-Authored-By: Claude Opus 5.5 --- packages/meshbay-hub/tests/test_security_headers.py | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) (limited to 'packages/meshbay-hub/tests/test_security_headers.py') diff --git a/packages/meshbay-hub/tests/test_security_headers.py b/packages/meshbay-hub/tests/test_security_headers.py index b068656..e6d431e 100644 --- a/packages/meshbay-hub/tests/test_security_headers.py +++ b/packages/meshbay-hub/tests/test_security_headers.py @@ -64,12 +64,12 @@ def test_the_policy_is_locked_down_where_it_matters(): assert "https:" not in script.split() -def test_recaptcha_is_the_only_external_origin(): - hosts = {"https://www.google.com", "https://www.gstatic.com"} +def test_no_external_origin(): + """The sign-up check is the hub's own proof of work, not a third party's.""" for part in CSP.split(";"): for tok in part.strip().split()[1:]: - if tok.startswith(("http://", "https://")): - assert tok in hosts, f"unexpected external origin in CSP: {tok}" + assert not tok.startswith(("http://", "https://")), ( + f"external origin in CSP: {tok}") def test_the_streamed_download_frame_is_allowed(): @@ -78,8 +78,8 @@ def test_the_streamed_download_frame_is_allowed(): The streamed-download path works by navigating a hidden iframe to `/_mbdl/` so the service worker is asked for the response it is already - holding. `frame-src` was tightened to reCAPTCHA's two origins when the - captcha needed a frame, and nobody connected the two: Chrome refused the + holding. `frame-src` was tightened to a third-party captcha's two origins + when it needed a frame, and nobody connected the two: Chrome refused the frame, the worker was never asked, and the page waited out its timeout for a download that could not happen. On Firefox and Safari that is the *only* way to write a large file to disk — there is no File System Access API and -- cgit v1.2.3