captcha

Overview ¶

Package captcha provides verification code management with Redis storage.

It supports creating, verifying, and deleting captcha codes with automatic expiration. Verification is atomic and one-time (code is deleted after successful verification).

Hertz Backend Setup ¶

// Initialize captcha with Redis client
cap := captcha.New(redisClient)

// Send captcha endpoint
h.POST("/captcha/send", func(ctx context.Context, c *app.RequestContext) {
	email := c.Query("email")
	code := help.Random(6) // Generate 6-digit code
	cap.Create(ctx, "login:"+email, code, 5*time.Minute)
	// Send code via email/SMS...
	c.JSON(200, utils.H{"message": "sent"})
})

// Verify captcha endpoint
h.POST("/captcha/verify", func(ctx context.Context, c *app.RequestContext) {
	email := c.Query("email")
	code := c.Query("code")
	if err := cap.Verify(ctx, "login:"+email, code); err != nil {
		c.JSON(400, utils.H{"error": err.Error()})
		return
	}
	c.JSON(200, utils.H{"message": "verified"})
})

Angular Frontend Setup ¶

// Send captcha request
sendCaptcha(email: string) {
  return this.http.post('/captcha/send', null, { params: { email } });
}

// Verify captcha
verifyCaptcha(email: string, code: string) {
  return this.http.post('/captcha/verify', null, { params: { email, code } });
}

Security Notes ¶

• Codes are deleted after successful verification (one-time use)
• Use appropriate TTL (e.g., 5 minutes) to limit attack window
• Consider rate limiting to prevent brute force attacks
• Use Redis key prefix to namespace different captcha types