reCAPTCHA

Go to https://www.google.com/recaptcha/admin and register your website for a Google reCAPTCHA. Choose reCAPTCHA v2.

Edit the file: /etc/hapee-2.3/hapee-lb-recaptcha.cfg. Find the line that reads:

recaptcha_private XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

and replace the value with the private key you got when you registered for a reCAPTCHA.

Search the file for data-sitekey and replace XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX with the corresponding public key you got when you registered for a reCAPTCHA.

Put a new random string in for hmac_secret to prevent someone else with this module from generating cookies for your site to get around the reCAPTCHA.

Optionally, change the values for ip_in_cookie and valid_duration:

• The ip_in_cookie setting will put the client's IP address into the HMAC so that cookie sharing is more difficult.

• The valid_duration setting sets how long in seconds the cookie will be accepted.

Add the following line to the global section of your HAProxy Enterprise configuration:

global
   lua-load /opt/hapee-2.3/modules/hapee-lb-recaptcha.luac

Add a new listen section to your HAProxy Enterprise configuration that will communicate with Google to verify reCAPTCHAs, as follows:

listen google_recaptcha
   mode http
   bind 127.0.0.1:3859
   option httpclose
   timeout server 5s
   timeout client 5s
   server google www.google.com:443 ssl verify none maxconn 10 check inter 60s fall 2 rise 2

Add the following tcp-request inspect-delay and http-request use-service lines inside any frontend or listen section from which you want to send reCAPTCHA challenges:

frontend www
   bind :80
   tcp-request inspect-delay 1s
   http-request use-service lua.verify_recaptcha if { path /.well-known/haproxy/captcha_callback }
   http-request use-service lua.request_recaptcha unless { lua.verify_solved_captcha "ok" }

You can add your conditions, such as detecting scrapers, to this rule if you don't want to require all visitors to solve a Captcha

Reload HAProxy Enterprise.

Make an HTTP request and see if it works. A client will need to solve the challenge before they can continue past the reCAPTCHA web page.

Check your logs carefully. In case of problems, multiple messages about it may appear but only one can point to the real problem.

Install the required package hapee-2.3r1-lb-htmldom

$ # On Debian/Ubuntu
$ sudo apt-get install hapee-2.3r1-lb-htmldom

$ # On CentOS/RedHat/Oracle/Photon OS
$ sudo yum install hapee-2.3r1-lb-htmldom

$ # On SUSE
$ sudo zypper install hapee-2.3r1-lb-htmldom

$ # On FreeBSD
$ sudo pkg install hapee-2.3r1-lb-htmldom

Go to https://www.google.com/recaptcha/admin and register your website for a Google reCAPTCHA. Choose reCAPTCHA v3.

Edit the file: /etc/hapee-2.3/hapee-lb-recaptcha.cfg. Find the line that reads:

"recaptcha_private_v3 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

and replace the value with the private key you got when you registered for a reCAPTCHA.

Put a new random string in for hmac_secret to prevent someone else with this module from generating cookies for your site to get around the reCAPTCHA.

Optionally, change the values for ip_in_cookie and valid_duration:

• The ip_in_cookie setting will put the client's IP address into the HMAC so that cookie sharing is more difficult.

• The valid_duration setting sets how long in seconds the cookie will be accepted.

Add the following line to the global section of your HAProxy Enterprise configuration:

global
   module-load hapee-lb-htmldom.so
   lua-load /opt/hapee-2.3/modules/hapee-lb-recaptcha.luac

Add the following lines inside any frontend or listen section from which you want to send reCAPTCHA challenges:

frontend www
   # reCAPTCHA logic
   stick-table  type string len 54  size 1m  expire 1h  store gpt0,http_req_rate(1h)
   http-request set-var(txn.captcha_version) int(3)
   acl is_captcha_callback path -i /.well-known/haproxy/captcha_callback
   http-request set-var(txn.captcha_resp) req.body_param(grecaptcharesp) if METH_POST is_captcha_callback
   http-request lua.get_captcha_score if METH_POST is_captcha_callback
   http-request track-sc0 lua.make_hmac_cookie if is_captcha_callback
   http-request capture var(txn.captcha_score) len 4 if METH_POST is_captcha_callback
   http-request sc-set-gpt0(0) 0 if { var(txn.captcha_score) -m int le 10 } is_captcha_callback
   http-request sc-set-gpt0(0) 1 if { var(txn.captcha_score) -m int gt 10 } is_captcha_callback
   http-request sc-set-gpt0(0) 2 if { var(txn.captcha_score) -m int gt 25 } is_captcha_callback
   http-request sc-set-gpt0(0) 3 if { var(txn.captcha_score) -m int gt 50 } is_captcha_callback
   http-request sc-set-gpt0(0) 4 if { var(txn.captcha_score) -m int gt 75 } is_captcha_callback
   http-request use-service lua.send_hmac_cookie if is_captcha_callback
   http-request track-sc0 req.cook(solved_captcha) if { req.cook(solved_captcha) -m found } !is_captcha_callback
   http-request capture sc_get_gpt0(0) len 1
   filter htmldom mode strict head-append '<script src="https://www.google.com/recaptcha/api.js?render=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"></script><script type="text/javascript" defer async>if(document.cookie.indexOf("solved_captcha") == -1) { grecaptcha.ready(function() { action=location.pathname.substring(location.pathname.lastIndexOf("/") + 1); action="index"; grecaptcha.execute("XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", {action: action}).then(function(token) { var captcha_resp_body = "grecaptcharesp=" + token + "&location=" + encodeURIComponent(document.URL); var makereport = new XMLHttpRequest(); makereport.open("POST", "/.well-known/haproxy/captcha_callback", true); makereport.setRequestHeader("Content-type", "application/x-www-form-urlencoded"); makereport.onreadystatechange = function () { if(makereport.readyState == 4 && makereport.status == 200 ) { document.cookie = "solved_captcha="+makereport.responseText; }}; makereport.send(captcha_resp_body); }) }) }</script>'

Replace "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" with the public key you got when you registered for a reCAPTCHA.

On its own, the module only records a score between 0 and 4, where 0 is the worst score, and stores it in the stick table. Retrieve the current user's score with the sc_get_gpt0(0) fetch method. You can add logic that uses the score when deciding whether to take action on a client's request. For example, you could simply deny all requests that have a score less than 2, or you could enforce stricter rate limiting. In the example below, we deny requests that have a score less than 2:

frontend www
   # reCAPTCHA logic from above not shown

   # deny requests that have a low score
   http-request deny if { sc_get_gpt0(0) lt 2 }

Reload HAProxy Enterprise.

Make an HTTP request and see if it works.