Captcha and FaceID Providers
Relevant source files
The following files were used as context for generating this wiki page:
Casdoor utilizes a provider-based architecture to integrate various third-party security services, specifically focusing on Captcha for bot prevention and FaceID for biometric authentication. These providers are managed within organizations and applications to secure sign-in and sign-up flows.
Sources: web/src/Setting.js:214-239, web/src/Setting.js:279-283
Captcha Providers
Captcha providers are used to verify that a user is human. Casdoor supports a wide range of industry-standard Captcha services, which can be configured to appear always, never, or dynamically based on login attempt failures.
Supported Captcha Types
Casdoor supports the following Captcha services:
| Provider Name | Type ID | Implementation Detail |
|---|---|---|
| Default | Default | Built-in Go-based image captcha |
| reCAPTCHA | reCAPTCHA v2 / v3 | Google reCAPTCHA service |
| hCaptcha | hCaptcha | hCaptcha service |
| Aliyun Captcha | Aliyun Captcha | Alibaba Cloud Captcha |
| GEETEST | GEETEST | GeeTest v4 CAPTCHA |
| Cloudflare Turnstile | Cloudflare Turnstile | Cloudflare's non-interactive challenge |
Sources: web/src/Setting.js:214-239, web/src/common/CaptchaWidget.js:31-140
Frontend Integration
The frontend utilizes a CaptchaModal and a CaptchaWidget to render challenges. The CaptchaWidget dynamically loads the necessary third-party scripts (e.g., api.js for reCAPTCHA or gt4.js for GeeTest) and initializes the provider's specific rendering logic.
Backend Verification (GeeTest Example)
For providers like GeeTest, the backend performs HMAC-SHA256 signing and sends a validation request to the provider's verification URL.
Sources: captcha/geetest.go:23-75
FaceID and Identity Verification (IDV)
Casdoor supports biometric login and real-name identity verification through specialized providers. These providers facilitate secure, passwordless authentication and regulatory compliance for user identity.
Biometric Auth (FaceID)
FaceID providers, such as Alibaba Cloud Facebody, are used during the login stage. The system initiates a FaceID sign-in flow through specific API endpoints.
API Endpoint for FaceID:
GET /api/faceid-signin-begin: Initiates the first stage of the FaceID login flow.
Sources: web/src/Setting.js:279-283, swagger/swagger.json:1159-1188
Identity Verification Providers
Identity Verification (IDV) providers are used to verify a user's real identity using documents or biometric checks.
| Provider Name | Type ID | Description |
|---|---|---|
| Jumio | Jumio | International ID verification service |
| Alibaba Cloud | Alibaba Cloud | Alibaba Cloud ID verification service |
Sources: web/src/Setting.js:290-297
Data Structures and Configuration
Providers are defined globally and then associated with specific applications. The configuration includes keys, secrets, and environment-specific settings (like Intranet vs Internet endpoints).
Provider Schema (Partial)
The following fields are common in the object.Provider definition related to Captcha and FaceID:
| Field | Type | Description |
|---|---|---|
category | string | Either "Captcha", "Face ID", or "ID Verification" |
type | string | The specific provider type (e.g., "reCAPTCHA v2") |
clientId | string | Often used as the "Site Key" for Captchas |
clientSecret | string | The secret key for backend-to-backend verification |
clientId2 | string | Secondary ID (e.g., SceneId for Aliyun) |
clientSecret2 | string | Secondary Secret or Region Prefix |
Sources: swagger/swagger.json:2065-2178
Application-Level Rules
Applications define how Captcha is enforced using the rule property within a ProviderItem.
| Rule Type | Behavior |
|---|---|
Always | Challenge is presented for every login/signup attempt. |
Never | Challenge is never presented. |
Dynamic | Challenge is presented based on risk or attempt counts. |
Internet-Only | Challenge is only presented for non-intranet IPs. |
Sources: web/src/common/modal/CaptchaModal.js:192-197, web/src/CaptchaPage.js:68-80
Conclusion
The integration of Captcha and FaceID providers in Casdoor provides a flexible, modular security layer. By supporting multiple industry-standard third-party services, Casdoor allows administrators to choose the best balance between user experience and security, ranging from non-interactive bot detection to robust biometric authentication.