Neutered Paranoid Meerkat

    middy-recaptcha
    TypeScript icon, indicating that this package has built-in type declarations

    0.2.2 • Public • Published

    🛵 🔐 reCAPTCHA Middleware for Middy

    reCAPTCHA validation Middy middleware for yours AWS Lambdas

    TypeScript

    Version   License   GitHub issues by-label

    Developed in 🇧🇷 Brazil

    🛵 What it does

    Middy is a very simple middleware engine that allows you to simplify your AWS Lambda code when using Node.js. As I always had to implement and reimplement this type of logic, I decide to wrap up and give back tcommunity middleware for that validates a reCAPTCHA token in the body of a POST request.

    If you are using Middy and have some public facing API you'll need more security (and believe me, better safe than sorry). This simple middleware will validate the token from reCAPTCHA v3.

    🚀 Install

    Use your favorite package manager:

    yarn add middy-recaptcha
    npm install middy-recaptcha -S

    Usage

    Besides @middy/core, you must also use @middy/http-json-body-parser since this middleware will read the request body and needed parsed as json.

    To integrte with your frontend you just need to follow the guide from reCAPTCHA to rogrammatically invoke the challenge. The you need to pass the token generate in the body of your post request like this example:

    const onSubmit = data => {
            setSubmited(true)
            window?.grecaptcha.ready(function() {
              window?.grecaptcha.execute('<Your public reCAPTCHA key>', {action: 'submit'}).then(function(token) {
                let payload = {
                  token: token // In the current version, it must be sent in the body of the POST as token.
                }
                setPayload(JSON.stringify(payload, null, 2))
              });
            });
      };

    In the folder backend you will find a CDK boilerplate to go up and running an HTTP API and in demo a simple NextJS example with the best react form lib[1]. These docs will be updated soon.

    Canonical example, most secure

    import middy from "@middy/core";
    import cors from "@middy/http-cors";
    import httpSecurityHeaders from "@middy/http-security-headers";
    import jsonBodyParser from "@middy/http-json-body-parser";
    import ssm from "@middy/ssm";
    import reCAPTCHA from "middy-recaptcha";
    
    
    import type {
      APIGatewayProxyEvent,
      APIGatewayProxyResult,
      Context,
    } from "aws-lambda";
    
    interface IReCAPTCHA extends Context {
      reCAPTCHA?: {
        success: boolean;
        challenge_ts: string;
        hostname: string;
        score: number;
        action: string;
      };
    }
    
    async function baseHandler(
      _event: APIGatewayProxyEvent,
      context: Context
    ): Promise<APIGatewayProxyResult> {
      const ctx: IReCAPTCHA = context;
    
      const message = {
        data: {
          message: "Hello from the other Side!",
          success: ctx?.reCAPTCHA?.success,
          score: ctx?.reCAPTCHA.score,
          challenge_ts: ctx?.reCAPTCHA?.challenge_ts,
          hostname: ctx?.reCAPTCHA?.hostname,
          action: ctx?.reCAPTCHA?.action,
        },
      };
    
      return {
        statusCode: 200,
        body: JSON.stringify(message, null, 2),
      };
    }
    
    let handler = middy(baseHandler);
    handler
      .use(
        ssm({
          fetchData: {
            // the keys (`recaptchaSecret` and `recaptchaThreshold`) are the keys picked up in `context` by `reCAPTCHA()`, if specified
            recaptchaSecret: "/dev/recaptcha/secret",
            recaptchaThreshold: "/dev/recaptcha/threshold", // defaults to 0.8 if not specified
          },
          setToContext: true,
        })
      )
      .use(jsonBodyParser())
      .use(cors())
      .use(httpSecurityHeaders())
      .use(reCAPTCHA()); // Here goes our Middleware. 
    
    export { handler };

    Fast example, but not so best in security practices

    // Everything the same, but you don't use "@middy/ssm" to fecth the secret key to validate in the backend your webapp, so it will need to pass the value as string as 'secret'. 
    let handler = middy(baseHandler);
    handler
      .use(
      .use(jsonBodyParser())
      .use(cors())
      .use(httpSecurityHeaders())
      .use(reCAPTCHA({
        secret: "<here goes your secret key>"
      })); // Here goes our Middleware.
    
    export { handler };

    With secretyou can load your secret key from an .env file or env parameters for your Lambda or hardcode the value. But, off course, none of us will ever do this kind of reckless nonsense.

    Wink

    Options

    Prop Type Description
    secret string Secret key from the reCAPTCHA admin. Highly recommend to use System Setting Manager.
    threshold number Default: 0.8 reCAPTCHA v3 returns a score (1.0 is very likely a good interaction, 0.0 is very likely a bot). Based on the score, you can take variable action in the context of your site. (Supports System Setting Manager via context)
    useIp boolean Default: false Optional. The user's IP address.
    tokenField string Default: token. The field on the event.body that has the reCaptcha token from your Frontend application.

    TODO

    • Improve docs. I want to do a write-up about the backend and frontend integration soon.

    Thanks

    All Middy contributors

    See Also

    📺 React Lite YouTube Embed: A private by default, faster and cleaner YouTube embed component for React applications

    MIT License

    Copyright (c) 2021 Ibrahim Cesar

    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.


    [1] In My Own Opinion®: React Hook Form

    Install

    npm i middy-recaptcha

    DownloadsWeekly Downloads

    38

    Version

    0.2.2

    License

    MIT

    Unpacked Size

    32 kB

    Total Files

    9

    Last publish

    Collaborators

    • ibrahimcesar