Cavemanon/haproxy-protection
8
Fork 0
mirror of https://gitgud.io/fatchan/haproxy-protection.git synced 2025-05-09 02:05:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

Make captcha submission automatic and not require clicking a "submit" form button

Browse Source
This commit is contained in:
Thomas Lynch
2022-09-18 01:41:02 +10:00
parent 3f40192d55
commit 0af1a740ab
3 changed files with 83 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
docker-compose.yml
View File

@ -24,8 +24,11 @@ services:
- ./haproxy/js/:/var/www/js/ - ./haproxy/js/:/var/www/js/
- ./haproxy/html/maintenance.html:/var/www/html/maintenance.html - ./haproxy/html/maintenance.html:/var/www/html/maintenance.html
environment: environment:
- RECAPTCHA_SECRET=6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe # These are the hcaptcha and recaptcha test keys, not leaking any dont worry :^)
- RECAPTCHA_SITEKEY=6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI - HCAPTCHA_SITEKEY=20000000-ffff-ffff-ffff-000000000002
- HCAPTCHA_SECRET=0x0000000000000000000000000000000000000000
#- RECAPTCHA_SECRET=6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe
#- RECAPTCHA_SITEKEY=6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI
- CAPTCHA_COOKIE_SECRET=changeme - CAPTCHA_COOKIE_SECRET=changeme
- POW_COOKIE_SECRET=changeme - POW_COOKIE_SECRET=changeme
- HMAC_COOKIE_SECRET=changeme - HMAC_COOKIE_SECRET=changeme

50
haproxy/js/challenge.js
View File

@ -1,15 +1,17 @@
function finishRedirect() {
window.location=location.search.slice(1)+location.hash || "/";
}
function finishPow(combined, answer) { function finishPow(combined, answer) {
document.cookie='z_ddos_pow='+combined+'#'+answer+';expires=Thu, 31-Dec-37 23:55:55 GMT; path=/; SameSite=Strict; '+(location.protocol==='https:'?'Secure=true; ':''); document.cookie='z_ddos_pow='+combined+'#'+answer+';expires=Thu, 31-Dec-37 23:55:55 GMT; path=/; SameSite=Strict; '+(location.protocol==='https:'?'Secure=true; ':'');
const submitButton = document.querySelector('input[type=submit]') const hasCaptchaForm = document.querySelector('form');
if (submitButton) { if (!hasCaptchaForm) {
//button is shown only if captcha is enabled finishRedirect();
submitButton.disabled = false;
submitButton.value = 'Submit';
} else {
window.location=location.search.slice(1)+location.hash || "/";
} }
} }
const powFinished = new Promise((resolve, reject) => {
window.addEventListener('DOMContentLoaded', (event) => {
const combined = document.querySelector('[data-pow]').dataset.pow; const combined = document.querySelector('[data-pow]').dataset.pow;
const [_userkey, challenge, _signature] = combined.split("#"); const [_userkey, challenge, _signature] = combined.split("#");
const start = Date.now(); const start = Date.now();
@ -23,7 +25,10 @@ if (window.Worker && crypto.subtle) {
const [workerId, answer] = e.data; const [workerId, answer] = e.data;
console.log('Worker', workerId, 'returned answer', answer, 'in', Date.now()-start+'ms'); console.log('Worker', workerId, 'returned answer', answer, 'in', Date.now()-start+'ms');
const dummyTime = 5000 - (Date.now()-start); const dummyTime = 5000 - (Date.now()-start);
window.setTimeout(() => finishPow(combined, answer), dummyTime); window.setTimeout(() => {
finishPow(combined, answer);
resolve();
}, dummyTime);
} }
const workers = []; const workers = [];
for (let i = 0; i < threads; i++) { for (let i = 0; i < threads; i++) {
@ -47,5 +52,32 @@ if (window.Worker && crypto.subtle) {
++i; ++i;
} }
const dummyTime = 5000 - (Date.now()-start); const dummyTime = 5000 - (Date.now()-start);
window.setTimeout(() => finishPow(combined, i), dummyTime); window.setTimeout(() => {
finishPow(combined, i);
resolve();
}, dummyTime);
} }
});
});
function onCaptchaSubmit(callback) {
const captchaElem = document.querySelector('[data-sitekey]');
captchaElem.insertAdjacentHTML('afterend', `<div class="lds-ring"><div></div><div></div><div></div><div></div></div>`);
captchaElem.remove();
powFinished.then(() => {
fetch('/bot-check', {
method: 'POST',
headers: {
'Content-Type': 'application/x-www-form-urlencoded',
},
body: new URLSearchParams({
'h-captcha-response': callback,
'g-recaptcha-response': callback,
}),
redirect: 'manual',
}).then(res => {
finishRedirect();
})
});
}

5
src/scripts/hcaptcha.lua
View File

@ -88,6 +88,7 @@ local body_template = [[
<noscript> <noscript>
<style>.jsonly{display:none}</style> <style>.jsonly{display:none}</style>
</noscript> </noscript>
<script src="/js/challenge.js"></script>
</head> </head>
<body data-pow="%s"> <body data-pow="%s">
%s %s
@ -102,7 +103,6 @@ local body_template = [[
<p>Security and Performance by <a href="https://gitgud.io/fatchan/haproxy-protection/">haproxy-protection</a></p> <p>Security and Performance by <a href="https://gitgud.io/fatchan/haproxy-protection/">haproxy-protection</a></p>
<p>Vey ID: <code>%s</code></p> <p>Vey ID: <code>%s</code></p>
</footer> </footer>
<script src="/js/challenge.js"></script>
</body> </body>
</html> </html>
]] ]]
@ -146,9 +146,8 @@ local captcha_section_template = [[
Please solve the captcha to continue. Please solve the captcha to continue.
</h3> </h3>
<form class="jsonly" method="POST"> <form class="jsonly" method="POST">
<div class="%s" data-sitekey="%s"></div> <div class="%s" data-sitekey="%s" data-callback="onCaptchaSubmit"></div>
<script src="%s" async defer></script> <script src="%s" async defer></script>
<input type="submit" value="Calculating proof of work..." disabled>
</form> </form>
]] ]]