reCAPTCHA

Go to https://www.google.com/recaptcha/admin and register your website for a Google reCAPTCHA. Choose reCAPTCHA v2. This will give you a site key and a secret key.

Edit the file: /etc/hapee-2.0/hapee-lb-recaptcha.cfg. Find the line that reads:

recaptcha_private XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

and replace the value with the secret key you got when you registered for a reCAPTCHA.

Search the file for data-sitekey and replace XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX with the corresponding site key you got when you registered for a reCAPTCHA.

Put a new random string in for hmac_secret to prevent someone else with this module from generating cookies for your site to get around the reCAPTCHA. This field is the HMAC secret used when encrypting the cookie that indicates whether the user has already solved the CAPTCHA. It can be any set of random numbers and letters. You can use the following command to create an alphanumeric string 42 characters long:

$ tr -cd [:alnum:] </dev/urandom | head -c 42

Optional: Change the values for ip_in_cookie and valid_duration:

• The ip_in_cookie setting will put the client's IP address into the HMAC so that cookie sharing is more difficult.

• The valid_duration setting sets how long in seconds the cookie will be accepted.

Add the following line to the global section of your HAProxy Enterprise configuration:

global
   lua-load /opt/hapee-2.0/modules/hapee-lb-recaptcha.luac

Add a new listen section to your HAProxy Enterprise configuration that will communicate with Google to verify reCAPTCHAs, as follows:

listen google_recaptcha
   mode http
   bind 127.0.0.1:3859
   option httpclose
   timeout server 5s
   timeout client 5s
   server google www.google.com:443 ssl verify none maxconn 10 check inter 60s fall 2 rise 2

Add the following tcp-request inspect-delay and http-request use-service lines inside any frontend or listen section from which you want to send reCAPTCHA challenges:

frontend www
   bind :80
   tcp-request inspect-delay 1s
   http-request use-service lua.verify_recaptcha if { path /.well-known/haproxy/captcha_callback }
   http-request use-service lua.request_recaptcha unless { lua.verify_solved_captcha "ok" }

Optional: Add other conditions to the if clauses to enable Google reCAPTCHA only for some requests. In the example below, we configure rate limiting so that the challenge displays only for clients that make more than 100 requests within 10 seconds:

# share requests rate data with load balancer peers
peers mycluster
  peer loadbalancer1 192.168.1.10:10000
  peer loadbalancer2 192.168.1.11:10000
  table request_rates type ip  size 1m  expire 10s  store http_req_rate(10s)

# listening proxy
frontend  fe_main
  bind *:80

  # track this client's request rate based on their IP address
  http-request track-sc0 src table mycluster/request_rates

  # reCAPTCHA logic with rate limit
  tcp-request inspect-delay 1s
  http-request use-service lua.verify_recaptcha if { path /.well-known/haproxy/captcha_callback }
  http-request use-service lua.request_recaptcha if { sc_http_req_rate(0,mycluster/request_rates) gt 100 } !{ lua.verify_solved_captcha "ok" }

Reload HAProxy Enterprise.

Make an HTTP request and see if it works. A client will need to solve the challenge before they can continue past the reCAPTCHA web page.

Check your logs carefully. In case of problems, multiple messages about it may appear but only one can point to the real problem.

Install the required package hapee-2.0r1-lb-htmldom

$ # On Debian/Ubuntu
$ sudo apt-get install hapee-2.0r1-lb-htmldom

$ # On CentOS/RedHat/Oracle
$ sudo yum install hapee-2.0r1-lb-htmldom

$ # On SUSE
$ sudo zypper install hapee-2.0r1-lb-htmldom

$ # On FreeBSD
$ sudo pkg install hapee-2.0r1-lb-htmldom

Go to https://www.google.com/recaptcha/admin and register your website for a Google reCAPTCHA. Choose reCAPTCHA v3.

Edit the file: /etc/hapee-2.0/hapee-lb-recaptcha.cfg. Find the line that reads:

"recaptcha_private_v3 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

and replace the value with the private key you got when you registered for a reCAPTCHA.

Put a new random string in for hmac_secret to prevent someone else with this module from generating cookies for your site to get around the reCAPTCHA.

Optionally, change the values for ip_in_cookie and valid_duration:

• The ip_in_cookie setting will put the client's IP address into the HMAC so that cookie sharing is more difficult.

• The valid_duration setting sets how long in seconds the cookie will be accepted.

Add the following line to the global section of your HAProxy Enterprise configuration:

global
   module-load hapee-lb-htmldom.so
   lua-load /opt/hapee-2.0/modules/hapee-lb-recaptcha.luac

Add the following lines inside any frontend or listen section from which you want to send reCAPTCHA challenges:

frontend www
   # reCAPTCHA logic
   stick-table  type string len 54  size 1m  expire 1h  store gpt0,http_req_rate(1h)
   http-request set-var(txn.captcha_version) int(3)
   acl is_captcha_callback path -i /.well-known/haproxy/captcha_callback
   http-request set-var(txn.captcha_resp) req.body_param(grecaptcharesp) if METH_POST is_captcha_callback
   http-request lua.get_captcha_score if METH_POST is_captcha_callback
   http-request track-sc0 lua.make_hmac_cookie if is_captcha_callback
   http-request capture var(txn.captcha_score) len 4 if METH_POST is_captcha_callback
   http-request sc-set-gpt0(0) 0 if { var(txn.captcha_score) -m int le 10 } is_captcha_callback
   http-request sc-set-gpt0(0) 1 if { var(txn.captcha_score) -m int gt 10 } is_captcha_callback
   http-request sc-set-gpt0(0) 2 if { var(txn.captcha_score) -m int gt 25 } is_captcha_callback
   http-request sc-set-gpt0(0) 3 if { var(txn.captcha_score) -m int gt 50 } is_captcha_callback
   http-request sc-set-gpt0(0) 4 if { var(txn.captcha_score) -m int gt 75 } is_captcha_callback
   http-request use-service lua.send_hmac_cookie if is_captcha_callback
   http-request track-sc0 req.cook(solved_captcha) if { req.cook(solved_captcha) -m found } !is_captcha_callback
   http-request capture sc_get_gpt0(0) len 1
   filter htmldom mode strict head-append '<script src="https://www.google.com/recaptcha/api.js?render=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"></script><script type="text/javascript" defer async>if(document.cookie.indexOf("solved_captcha") == -1) { grecaptcha.ready(function() { action=location.pathname.substring(location.pathname.lastIndexOf("/") + 1); action="index"; grecaptcha.execute("XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", {action: action}).then(function(token) { var captcha_resp_body = "grecaptcharesp=" + token + "&location=" + encodeURIComponent(document.URL); var makereport = new XMLHttpRequest(); makereport.open("POST", "/.well-known/haproxy/captcha_callback", true); makereport.setRequestHeader("Content-type", "application/x-www-form-urlencoded"); makereport.onreadystatechange = function () { if(makereport.readyState == 4 && makereport.status == 200 ) { document.cookie = "solved_captcha="+makereport.responseText; }}; makereport.send(captcha_resp_body); }) }) }</script>'

Replace "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" with the public key you got when you registered for a reCAPTCHA.

On its own, the module only records a score between 0 and 4, where 0 is the worst score, and stores it in the stick table. Retrieve the current user's score with the sc_get_gpt0(0) fetch method. You can add logic that uses the score when deciding whether to take action on a client's request. For example, you could simply deny all requests that have a score less than 2, or you could enforce stricter rate limiting. In the example below, we deny requests that have a score less than 2:

frontend www
   # reCAPTCHA logic from above not shown

   # deny requests that have a low score
   http-request deny if { sc_get_gpt0(0) lt 2 }

Reload HAProxy Enterprise.

Make an HTTP request and see if it works.