feat: add Turnstile CAPTCHA support for login#382
Open
Hzend wants to merge 3 commits into
Open
Conversation
added 2 commits
May 13, 2026 21:38
- Reuse existing registration verification infrastructure - Support three modes: Always ON / Always OFF / After N failures - Default disabled (login_verify=1), no impact on existing users - Track login failures per IP, clear on successful login - OAuth login bypasses verification (consistent with register behavior) 后端： - entity/setting.js: add login_verify, login_verify_count columns - entity-const.js: add verifyRecordType.LOGIN = 2 - verify-record-service.js: add isOpenLoginVerify, increaseLoginCount, clearLoginCount - login-service.js: verify Turnstile before password check; increment/clear failure count - setting-service.js: return loginVerifyOpen in get() and websiteConfig() - init.js: add v3_1DB() migration for schema upgrade 前端： - request/login.js: pass token param - login/index.vue: conditionally render Turnstile widget - sys-setting/index.vue: add Login Verification config UI - i18n zh/en: add loginVerification translation key
# Conflicts: # mail-worker/src/init/init.js
- Change login widget class from .register-turnstile to .login-turnstile - Add independent loginTurnstileId, loginBotJsError, loginVerifyErrorCount - Add onLoginTurnstileSuccess/Error callbacks - Prevent collision with registration Turnstile widget
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add Turnstile human verification for the
/api/loginendpoint to protect against brute-force attacks.Motivation
Currently, the login endpoint (
POST /api/login) has no CAPTCHA protection, making it vulnerable to automated brute-force attacks. This PR extends the existing Turnstile verification infrastructure (already used for registration) to also cover login.Changes
Backend
login_verifyandlogin_verify_countcolumns tosettingtablelogin_verifyandlogin_verify_countfields tov3_1DB()ininit.jsverifyRecordType.LOGIN = 2verify-record-service.js: AddisOpenLoginVerify,increaseLoginCount,clearLoginCountlogin-service.js: Verify Turnstile token before password check; increment failure count on error; clear on successsetting-service.js: ReturnloginVerifyOpeninget()andwebsiteConfig()Frontend
loginVerifyconfigtokenparam inlogin()requestloginVerificationkey (zh/en)Verification Modes
loginVerifyCountfailures from same IPBackwards Compatibility
login_verify = 1(CLOSE): existing users are unaffected/loginaccepts optionaltokenparam: old clients work without changesDEFAULTvalues: safe for existing deploymentsTesting
loginVerify = CLOSEloginVerify = OPEN