Mirroristas/pow-captcha
2
0
Fork 0
mirror of https://github.com/sequentialread/pow-captcha.git synced 2025-03-30 15:08:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

fixes after rename

Browse Source
This commit is contained in:
forest 2024-12-09 23:28:41 -06:00
parent 90c777a7e1
commit 0128784617
7 changed files with 84 additions and 74 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
README.md
View File

@ -199,7 +199,7 @@ download the `pow-bot-deterrent.css` and `proofOfWorker.js` files. There is noth
Set this property to one of the challenge strings returned by `GetChallenges`. It must be unique, each challenge can only be used once.
⚠️ **NOTE** that the element with the 3 `pow-botdeterrent-xyz` data properties **MUST** be placed **inside a form element**. This is required, to allow the bot deterrent to know which input elements it needs to trigger on. We only want it to trigger when the user actually intends to submit the form; otherwise we are wasting a lot of their CPU cycles for no reason!
⚠️ **NOTE** that the element with the 3 `pow-bot-deterrent-xyz` data properties **MUST** be placed **inside a form element**. This is required, to allow the bot deterrent to know which input elements it needs to trigger on. We only want it to trigger when the user actually intends to submit the form; otherwise we are wasting a lot of their CPU cycles for no reason!
#### `data-pow-bot-deterrent-callback`
@ -234,7 +234,7 @@ Then you would provide your callback like so:
When `pow-bot-deterrent.js` runs, if it finds an element with `data-pow-bot-deterrent-challenge` & `data-pow-bot-deterrent-callback`, but the callback function is not defined yet, it will print a warning message. If the callback is still not defined when the Proof of Work is completed, it will throw an error.
> 💬 *INFO* the element with the `pow-botdeterrent` data properties should probably be styled to have a very small font size. When I was designing the css for the bot deterrent element, I made everything scale based on the font size (by using `em`). But because the page I was testing it on had a small font by default, I accidentally made it huge when it is rendered on a default HTML page. So for now you will want to make the font size of the element which contains it fairly small, like `10px` or `11px`.
> 💬 *INFO* the element with the `pow-bot-deterrent` data properties should probably be styled to have a very small font size. When I was designing the css for the bot deterrent element, I made everything scale based on the font size (by using `em`). But because the page I was testing it on had a small font by default, I accidentally made it huge when it is rendered on a default HTML page. So for now you will want to make the font size of the element which contains it fairly small, like `10px` or `11px`.
#### `window.botBotDeterrentInit`
@ -309,7 +309,7 @@ function MyComponent({botDeterrentURL, challenge}) {
<form>
<input type="text" name="item" />
<input type="submit" disabled={nonce === ""} value="Add" />
<div className="botdeterrent-container"
<div className="bot-deterrent-container"
data-pow-bot-deterrent-url={botDeterrentURL}
data-pow-bot-deterrent-challenge={challenge}
data-pow-bot-deterrent-callback={uniqueCallback}>
@ -469,7 +469,7 @@ There are two main important parts, the form and the javascript at the bottom:
<input type="hidden" name="challenge" value="{{ .Challenge }}" />
<input type="hidden" name="nonce" />
<input type="submit" disabled="true" value="Add" />
<div class="botdeterrent-container"
<div class="bot-deterrent-container"
data-pow-bot-deterrent-url="{{ .PowAPIURL }}"
data-pow-bot-deterrent-challenge="{{ .Challenge }}"
data-pow-bot-deterrent-callback="myPowCallback">
@ -487,7 +487,7 @@ There are two main important parts, the form and the javascript at the bottom:
<script src="{{ .PowAPIURL }}/static/pow-bot-deterrent.js"></script>
```
⚠️ **NOTE** that the element with the `pow-botdeterrent` data properties is placed **inside a form element**. This is required because the bot deterrent needs to know which input elements it should trigger on. We only want it to trigger when the user actually intends to submit the form; otherwise we are wasting a lot of their CPU cycles for no reason!
⚠️ **NOTE** that the element with the `pow-bot-deterrent` data properties is placed **inside a form element**. This is required because the bot deterrent needs to know which input elements it should trigger on. We only want it to trigger when the user actually intends to submit the form; otherwise we are wasting a lot of their CPU cycles for no reason!
> 💬 *INFO* The double curly brace elements like `{{ .Challenge }}` are Golang string template interpolations. They are specific to the example app & how it renders the page.
@ -496,12 +496,12 @@ property. It will then validate each element to make sure it also has the `data-
When the Proof of Work finishes, `pow-bot-deterrent.js` will call the function specified by `data-pow-bot-deterrent-callback`, passing the winning nonce as the first argument, or throw an error if that function is not defined.
> 💬 *INFO* the element with the `pow-botdeterrent` data properties also has a class that *WE* defined, called `botdeterrent-container`.
> 💬 *INFO* the element with the `pow-bot-deterrent` data properties also has a class that *WE* defined, called `bot-deterrent-container`.
This class has a very small font size. When I was designing the css for the bot deterrent element, I made everything scale based on the font size (by using `em`). But because the page I was testing it on had a small font by default, I accidentally made it huge when it is rendered on a default HTML page. So for now you will want to make the font size of the element which contains it fairly small.
```
<style>
.botdeterrent-container {
.bot-deterrent-container {
margin-top: 1em;
font-size: 10px;
}

6
example/index.html
View File

@ -5,7 +5,7 @@
<title>📋 Todo List</title>
<meta name="viewport" content="width=device-width, initial-scale=1">
<style>
.botdeterrent-container {
.bot-deterrent-container {
margin-top: 1em;
font-size: 10px;
}
@ -32,7 +32,7 @@
<input type="hidden" name="challenge" value="{{ .Challenge }}" />
<input type="hidden" name="nonce" />
<input type="submit" disabled="true" value="Add" />
<div class="botdeterrent-container"
<div class="bot-deterrent-container"
data-pow-bot-deterrent-url="http://localhost:8080/"
data-pow-bot-deterrent-challenge="{{ .Challenge }}"
data-pow-bot-deterrent-callback="myPowCallback">
@ -47,7 +47,7 @@
document.querySelector("form input[type='submit']").disabled = false;
};
</script>
<script src="/static/botdeterrent.js"></script>
<script src="/static/pow-bot-deterrent.js"></script>
<!-- <script src='./static/scrypt_wasm.js'></script>
<script>
const { scrypt } = wasm_bindgen;

30
example/main.go
View File

@ -5,6 +5,7 @@ import (
"encoding/json"
"fmt"
"html/template"
"io"
"io/ioutil"
"log"
"net/http"
@ -25,8 +26,8 @@ var items []string
// 5 bits of difficulty, 1 in 2^6 (1 in 32) tries will succeed on average.
//
// 8 bits of difficulty would be ok for apps that are never used on mobile phones, 6 is better suited for mobile apps
const powDifficultyLevel = 5
// 7 bits of difficulty would be ok for apps that are never used on mobile phones, 5 is better suited for mobile apps
const powDifficultyLevel = 7
func main() {
@ -50,7 +51,7 @@ func main() {
panic(errors.Wrap(err, "can't start the app because could not loadChallenges():"))
}
_, err = ioutil.ReadFile("index.html")
_, err = os.ReadFile("index.html")
if err != nil {
panic(errors.Wrap(err, "can't start the app because can't open the template file. Are you in the right directory? "))
}
@ -62,7 +63,7 @@ func main() {
// The user submitted a POST request, attempting to add a new item to the list
if request.Method == "POST" {
// Ask the botdeterrent server if the user's proof of work result is legit,
// Ask the bot deterrent server if the user's proof of work result is legit,
// and if not, return HTTP 400 Bad Request
err := request.ParseForm()
if err == nil {
@ -77,6 +78,9 @@ func main() {
// Validation passed, add the user's new item to the list
items = append(items, request.Form.Get("item"))
http.Redirect(responseWriter, request, "/", http.StatusFound)
return
}
// if it looks like we will run out of challenges soon, then kick off a goroutine to go get more in the background
@ -87,12 +91,12 @@ func main() {
}
// if we somehow completely ran out of challenges, load more synchronously
if powChallenges == nil || len(powChallenges) == 0 {
if len(powChallenges) == 0 {
err = loadChallenges(apiToken)
if err != nil {
log.Printf("loading botdeterrent challenges failed: %v", err)
log.Printf("loading bot deterrent challenges failed: %v", err)
responseWriter.WriteHeader(500)
responseWriter.Write([]byte("botdeterrent api error"))
responseWriter.Write([]byte("bot deterrent api error"))
return
}
}
@ -183,7 +187,7 @@ func loadChallenges(apiToken string) error {
if response.StatusCode != 200 {
return fmt.Errorf(
"load proof of work botdeterrent challenges api returned http %d: %s",
"load proof of work bot deterrent challenges api returned http %d: %s",
response.StatusCode, string(responseBytes),
)
}
@ -194,7 +198,7 @@ func loadChallenges(apiToken string) error {
}
if len(powChallenges) == 0 {
return errors.New("proof of work botdeterrent challenges api returned empty array")
return errors.New("proof of work bot deterrent challenges api returned empty array")
}
return nil
@ -224,7 +228,13 @@ func validatePow(apiToken, challenge, nonce string) error {
}
if response.StatusCode != 200 {
return errors.New("proof of work botdeterrent validation failed")
bodyString := "http read error"
bytez, err := io.ReadAll(response.Body)
if err == nil {
bodyString = string(bytez)
}
log.Printf("validation failed: HTTP %d: %s\n", response.StatusCode, bodyString)
return errors.New("PoW bot deterrent validation failed")
}
return nil
}

11
main.go
View File

@ -48,7 +48,7 @@ func main() {
batchSize := 1000
deprecateAfterBatches := 10
portNumber := 2370
scryptCPUAndMemoryCost := 4096
scryptCPUAndMemoryCost := 16384
batchSizeEnv := os.ExpandEnv("$POW_BOT_DETERRENT_BATCH_SIZE")
deprecateAfterBatchesEnv := os.ExpandEnv("$POW_BOT_DETERRENT_DEPRECATE_AFTER_BATCHES")
portNumberEnv := os.ExpandEnv("$POW_BOT_DETERRENT_LISTEN_PORT")
@ -277,8 +277,8 @@ func main() {
for j := 0; j < len(difficultyBytes); j++ {
difficultyByte := byte(0)
for k := 0; k < 8; k++ {
currentBitIndex := (len(difficultyBytes) * 8) - (j*8 + k)
if currentBitIndex > difficultyLevel {
currentBitIndex := (j*8 + (7 - k))
if currentBitIndex+1 > difficultyLevel {
difficultyByte = difficultyByte | 1<<k
}
}
@ -400,7 +400,10 @@ func main() {
}
hashHex := hex.EncodeToString(hash)
if hashHex[len(hashHex)-len(challenge.Difficulty):] > challenge.Difficulty {
endOfHash := hashHex[len(hashHex)-len(challenge.Difficulty):]
log.Printf("endOfHash: %s <= Difficulty: %s", endOfHash, challenge.Difficulty)
if endOfHash > challenge.Difficulty {
errorMessage := fmt.Sprintf(
"400 bad request: nonce given by url param ?nonce=%s did not result in a hash that meets the required difficulty",
nonceHex,

34
static/captcha.css → static/pow-bot-deterrent.css
View File

@ -1,4 +1,4 @@
.pow-botdeterrent {
.pow-bot-deterrent {
background-color: #ddd;
border: 1px solid #9359fa;
border-radius: 1em;
@ -10,7 +10,7 @@
min-width: 37em;
}
.pow-botdeterrent-link {
.pow-bot-deterrent-link {
color: #452775;
font-weight: bold;
text-decoration: underline;
@ -19,28 +19,28 @@
}
@media screen and (max-width: 410px) {
.pow-botdeterrent {
.pow-bot-deterrent {
min-width: 25em;
}
.pow-botdeterrent-icon {
.pow-bot-deterrent-icon {
height: 3em;
}
}
@media screen and (max-width: 380px) {
.pow-botdeterrent-link span {
.pow-bot-deterrent-link span {
display: none;
}
}
.pow-botdeterrent-link:hover,
.pow-botdeterrent-link:active,
.pow-botdeterrent-link:visited {
.pow-bot-deterrent-link:hover,
.pow-bot-deterrent-link:active,
.pow-bot-deterrent-link:visited {
color: #452775;
}
.pow-botdeterrent-row {
.pow-bot-deterrent-row {
display: inline-flex;
flex-direction: row;
align-content: center;
@ -48,14 +48,14 @@
justify-content: space-between;
}
.pow-botdeterrent-icon-container {
.pow-bot-deterrent-icon-container {
margin-left: 1.5em;
margin-top: 0.2em;
margin-bottom: -2em;
margin-right: 0.2em;
}
.pow-botdeterrent-best-hash {
.pow-bot-deterrent-best-hash {
font-family: monospace;
background: #585a29;
color: #f6ff72;
@ -70,17 +70,17 @@
float: right;
}
.pow-botdeterrent-best-hash-done {
.pow-bot-deterrent-best-hash-done {
background: #3b6262;
color: #53f65d;
}
.pow-botdeterrent-description {
.pow-bot-deterrent-description {
margin-top: 1em;
font-size: 1em;
}
.pow-botdeterrent-progress-bar-container {
.pow-bot-deterrent-progress-bar-container {
border-radius: 1em;
background: #444;
height: 1em;
@ -90,7 +90,7 @@
}
.pow-botdeterrent-progress-bar {
.pow-bot-deterrent-progress-bar {
background: #f6ff72;
height: 1em;
width: 0;
@ -98,11 +98,11 @@
transition: width 0.5s ease-in-out;
}
.pow-botdeterrent-icon {
.pow-bot-deterrent-icon {
height: 4em;
}
.pow-botdeterrent-hidden {
.pow-bot-deterrent-hidden {
display: none;
}

59
static/captcha.js → static/pow-bot-deterrent.js
View File

@ -20,12 +20,11 @@
challenges.forEach(element => {
data-pow-bot-deterrent
if(!url) {
if(!element.dataset.powBotDeterrentAPIURL) {
if(!element.dataset.powBotDeterrentUrl) {
console.error("error: element with data-pow-bot-deterrent-challenge property is missing the data-pow-bot-deterrent-url property");
}
url = element.dataset.sqrpowAPIURL;
url = element.dataset.powBotDeterrentUrl;
if(url.endsWith("/")) {
url = url.substring(0, url.length-1)
}
@ -67,7 +66,7 @@
cssIsAlreadyLoaded = cssIsAlreadyLoaded || Array.from(document.styleSheets).some(x => {
try {
return Array.from(x.rules).some(x => x.selectorText == ".pow-botdeterrent")
return Array.from(x.rules).some(x => x.selectorText == ".pow-bot-deterrent")
} catch (err) {
return false
}
@ -93,9 +92,9 @@
attempts: 0,
startTime: new Date().getTime(),
};
const progressBarContainer = element.querySelector(".pow-botdeterrent-progress-bar-container");
const progressBarContainer = element.querySelector(".pow-bot-deterrent-progress-bar-container");
progressBarContainer.style.display = "block";
const mainElement = element.querySelector(".pow-botdeterrent");
const mainElement = element.querySelector(".pow-bot-deterrent");
mainElement.style.display = "inline-block";
const gears = element.querySelector(".pow-gears-icon");
gears.style.display = "block";
@ -108,8 +107,8 @@
challengesMap[challenge].attempts
);
const element = challengesMap[challenge].element;
const progressBar = element.querySelector(".pow-botdeterrent-progress-bar");
const bestHashElement = element.querySelector(".pow-botdeterrent-best-hash");
const progressBar = element.querySelector(".pow-bot-deterrent-progress-bar");
const bestHashElement = element.querySelector(".pow-bot-deterrent-best-hash");
bestHashElement.textContent = getHashProgressText(challengesMap[challenge]);
progressBar.style.width = `${probabilityOfSuccessSoFar*100}%`;
}
@ -168,14 +167,14 @@
clearInterval(challengeState.updateProgressInterval);
const element = challengeState.element;
const progressBar = element.querySelector(".pow-botdeterrent-progress-bar");
const progressBar = element.querySelector(".pow-bot-deterrent-progress-bar");
const checkmark = element.querySelector(".pow-checkmark-icon");
const gears = element.querySelector(".pow-gears-icon");
const bestHashElement = element.querySelector(".pow-botdeterrent-best-hash");
const description = element.querySelector(".pow-botdeterrent-description");
const bestHashElement = element.querySelector(".pow-bot-deterrent-best-hash");
const description = element.querySelector(".pow-bot-deterrent-description");
challengeState.smallestHash = e.data.smallestHash;
bestHashElement.textContent = getHashProgressText(challengeState);
bestHashElement.classList.add("pow-botdeterrent-best-hash-done");
bestHashElement.classList.add("pow-bot-deterrent-best-hash-done");
checkmark.style.display = "block";
checkmark.style.animationPlayState = "running";
gears.style.display = "none";
@ -186,11 +185,11 @@
description,
"a",
{"href": "https://en.wikipedia.org/wiki/Proof_of_work"},
"Proof of Work"
"PoW"
);
appendFragment(description, " complete, you may now submit your post. ");
appendFragment(description, " complete, you may continue.");
createElement(description, "br");
appendFragment(description, "This an accessible & privacy-respecting anti-spam measure. ");
appendFragment(description, "Privacy-respecting anti-spam measure.");
webWorkers.forEach(x => x.postMessage({stop: "STOP"}));
@ -256,7 +255,7 @@
hashesPerSecond = `[${leftPad(Math.round(hashesPerSecondFloat), 3)}h/s]`;
}
return `${hashesPerSecond} ..${challengeState.smallestHash} → ..${challengeState.difficulty}`;
return `${hashesPerSecond} ${challengeState.smallestHash} < ${challengeState.difficulty}`;
}
function leftPad (str, max) {
@ -271,24 +270,22 @@
parent.innerHTML = "";
const main = createElement(parent, "div", {"class": "pow-botdeterrent pow-botdeterrent-hidden"});
const mainRow = createElement(main, "div", {"class": "pow-botdeterrent-row"});
const main = createElement(parent, "div", {"class": "pow-bot-deterrent pow-bot-deterrent-hidden"});
const mainRow = createElement(main, "div", {"class": "pow-bot-deterrent-row"});
const mainColumn = createElement(mainRow, "div");
const headerRow = createElement(mainColumn, "div");
const headerLink = createElement(
headerRow,
mainColumn,
"a",
{
"class": "pow-botdeterrent-link",
"class": "pow-bot-deterrent-link",
"href": "https://git.sequentialread.com/forest/pow-bot-deterrent",
"target": "_blank"
},
"💥PoW! "
);
createElement(headerLink, "span", null, "Bot Deterrent");
createElement(headerRow, "div", {"class": "pow-botdeterrent-best-hash"}, "loading...");
const description = createElement(mainColumn, "div", {"class": "pow-botdeterrent-description"});
appendFragment(description, "Please wait for your browser to calculate a ");
const description = createElement(mainColumn, "div", {"class": "pow-bot-deterrent-description"});
appendFragment(description, "Creating ");
createElement(
description,
"a",
@ -297,12 +294,14 @@
);
appendFragment(description, ". ");
createElement(description, "br");
appendFragment(description, "This an accessible & privacy-respecting anti-spam measure. ");
appendFragment(description, "Privacy-respecting anti-spam measure.");
const bestHashContainer = createElement(mainRow, "div");
createElement(bestHashContainer, "div", {"class": "pow-bot-deterrent-best-hash"}, "loading...");
const progressBarContainer = createElement(main, "div", {
"class": "pow-botdeterrent-progress-bar-container pow-botdeterrent-hidden"
"class": "pow-bot-deterrent-progress-bar-container pow-bot-deterrent-hidden"
});
createElement(progressBarContainer, "div", {"class": "pow-botdeterrent-progress-bar"});
const iconContainer = createElement(mainRow, "div", {"class": "pow-botdeterrent-icon-container"});
createElement(progressBarContainer, "div", {"class": "pow-bot-deterrent-progress-bar"});
const iconContainer = createElement(mainRow, "div", {"class": "pow-bot-deterrent-icon-container"});
const checkmarkIcon = createElementNS(iconContainer, svgXMLNS, "svg", {
@ -310,7 +309,7 @@
"xml:space": [xmlSpaceXMLNS, 'preserve'],
"version": "1.1",
"viewBox": "0 0 512 512",
"class": "pow-checkmark-icon pow-botdeterrent-icon pow-botdeterrent-hidden"
"class": "pow-checkmark-icon pow-bot-deterrent-icon pow-bot-deterrent-hidden"
});
createElementNS(checkmarkIcon, svgXMLNS, "polyline", {
"class": "pow-checkmark-icon-checkmark",
@ -326,7 +325,7 @@
"xml:space": [xmlSpaceXMLNS, 'preserve'],
"version": "1.1",
"viewBox": "-30 -5 250 223",
"class": "pow-gears-icon pow-botdeterrent-icon pow-botdeterrent-hidden"
"class": "pow-gears-icon pow-bot-deterrent-icon pow-bot-deterrent-hidden"
});
createElementNS(gearsIcon, svgXMLNS, "path", {
"class": "pow-gears-icon-gear-large",

4
static/proofOfWorker.js
View File

@ -9,7 +9,7 @@ let scrypt;
let scryptPromise;
let working = false;
const batchSize = 8;
const batchSize = 4;
onmessage = function(e) {
if(e.data.stop) {
@ -92,8 +92,6 @@ onmessage = function(e) {
challenge.paralellization,
challenge.keyLength
);
//console.log(i.toString(16), hashHex);
const endOfHash = hashHex.substring(hashHex.length-challenge.difficulty.length);
if(endOfHash < smallestHash) {