stuartpb / recaptchable

Helps display and validate Recaptchas for node.js

node-recaptcha

node-recaptcha renders and verifies Recaptcha captchas.

Installation

Via git:

$ git clone git://github.com/mirhampt/node-recaptcha.git ~/.node_libraries/node-recaptcha

Via npm:

$ npm install recaptcha

Setup

Before you can use this module, you must visit http://www.google.com/recaptcha to request a public and private API key for your domain.

Running the Tests

To run the tests for this module, you will first need to install nodeunit. Then, simply run:

$ nodeunit test.js

Customizing the Recaptcha

See these instructions for help customizing the look of Recaptcha. In brief, you will need to add a structure like the following before the form in your document:

<script type="text/javascript">
    var RecaptchaOptions = {
       theme : 'clean',
       lang  : 'en'
    };
</script>

Example Using Express

app.js:

var express  = require('express'),
    Recaptcha = require('recaptcha').Recaptcha;

var PUBLIC_KEY  = 'YOUR_PUBLIC_KEY',
    PRIVATE_KEY = 'YOUR_PRIVATE_KEY';

var app = express.createServer();

app.configure(function() {
    app.use(express.bodyParser());
});

app.get('/', function(req, res) {
    var recaptcha = new Recaptcha(PUBLIC_KEY, PRIVATE_KEY);

    res.render('form.jade', {
        layout: false,
        locals: {
            recaptcha_form: recaptcha.toHTML()
        }
    });
});

app.post('/', function(req, res) {
    var data = {
        remoteip:  req.connection.remoteAddress,
        challenge: req.body.recaptcha_challenge_field,
        response:  req.body.recaptcha_response_field
    };
    var recaptcha = new Recaptcha(PUBLIC_KEY, PRIVATE_KEY, data);

    recaptcha.verify(function(success, error_code) {
        if (success) {
            res.send('Recaptcha response valid.');
        }
        else {
            // Redisplay the form.
            res.render('form.jade', {
                layout: false,
                locals: {
                    recaptcha_form: recaptcha.toHTML()
                }
            });
        }
    });
});

app.listen(3000);

views/form.jade:

form(method='POST', action='.')
  != recaptcha_form

  input(type='submit', value='Check Recaptcha')

Make sure express and jade are installed, then:

$ node app.js

recaptchable's Issues

Change `verify` function signature

Verify should take the data it's verifying as the first argument. In the current construction, it takes it as an argument to the constructor (so you have to construct a new instance for every request, which is cuckoo crazytown bananapants).

As for the callback, it should be changed to take an err, with err being a new Error() with code being the error code, and message being maybe the error code explanation from https://developers.google.com/recaptcha/docs/verify (if recognized)? This way, it would match the async signature of every other function in node

Add middleware

https://www.npmjs.org/package/connect-recaptcha is an example: check if the incoming request has the requisite reCAPTCHA fields, and, if it does, check validation of the reCAPTCHA fields before passing along to the next middleware function, adding the results as a "res.recaptcha" object.

(The user may want to have some kind of parameter-validation middleware before this middleware call if they want recaptcha-less requests to be an error.)

Change `toHTML` to `widget` or similar

Obviously we can leave toHTML for some semblance of backwards compatibility, but the only thing that should have a toHTML is the return value from a template language.

Take options object as alternative to private/public keys

Also, ditch the current other two parameters: data should be an argument to verify (not the constructor, WTF), and the secure boolean is basically a huge mistake.

Options:

• protocol: The protocol that will be used for all requests. Defaults to 'https://'. Can be '//', in which case validation requests will be made over HTTPS and inclusions for the widget will be protocol-relative.
• RecaptchaOptions: If present, the widget/toHTML output will be prefixed with a <script> that shadows any existing RecaptchaOptions with the values from this.
• customWidgetId: Equivalent to / overrides RecaptchaOptions.custom_theme_widget.
• customWidgetHTML: Custom theme widget HTML. If present, the RecaptchaOptions shadowing <script> will be added, with a default value of "recaptcha_widget" for RecaptchaOptions.custom_theme_widget (if not specified via RecaptchaOptions). The content of customWidget will be prepended to the widget/toHTML output, in a div with the id that RecaptchaOptions.custom_theme_widget is set to.

These keys will also be shadowed into RecaptchaOptions:

• lang
• theme
• custom_translations or customTranslations
• custom_theme_widget or customThemeWidget (will also be overridden by customWidgetId)
• tabindex

Also, note that I would generally consider RecaptchaOptions to be a presentation detail that should be handled in the template- all these options in the constructor are just an alternative. (You don't even need to use .widget/.toHTML at all.)