Anyone with experience on adding captcha validation on self-hosted Kratos for password only authentication? I can’t use CF under attack mode models with captcha or similar. I tried to check if it was feasable to use hooks but even with web_hook we are really limited as we can’t access request body and we can only access a limited set of request_headers. The only approach I’m thinkng of at the moment is to build a custom Traefik plugin and manage this on proxy

We have build an integration with cloudflare turnstile in Kratos OEL. Other providers could also be supported with a bit of work.

@steep-lamp-91158 I do respect your work and I understand that it has to pay off somehow, but I don’t understand how captchas are an enterprise feature when the whole project is based on having an open-source secure authentication system, and captchas are mandatory when dealing with password login / registration or recovery. Anyway just to have an idea what’s the starting price for Ory OEL?

The point is that an integration with a proprietary vendor is not well-placed in an open source repo really, although we also support some proprietary OIDC providers 🤷 It is definitely possible to also implement that on your side, the pointer here is the

transient_payload

. For a quote on OEL, I recommend to reach out to https://www.ory.com/contact as it highly depends on what you need.

I do completely agree on not having proprietary vendors captchas inside the repository, don’t get me wrong. Let’s make an example as I might have missed a functionality: I can include the captcha token inside

transient_payload

add an

after

hook (because documentation mentions that

transient_payload

is only available in

after

hooks), make it so that the action is only triggered on

password

method for login and registration flows then trigger a flow-interrupting web_hook action. Now my question here is: do flow-interrupting hooks rollback the database transaction? More specifically for registration the documentation says:

after registration: The hook runs when a user successfully registers in the system.

Would an hook (webhook) executed after registration flow that interrupts the flow rollback the user registration / prevent it to be finalized?

just my $0.05c's worth - but wouldn't a diferent flow give you the same results, like email verification upon registration along with enforcing totp/passkeys Pointing to docs - https://www.ory.com/docs/kratos/mfa/totp https://www.ory.com/docs/kratos/mfa/webauthn-fido-yubikey) this removes the requirement for "proprietary extensions"

@late-rocket-58728 Maybe for authentication, but what about registration via password, someone could spam requests (IP based rate limit is easily eludibile) and I get the database filled with users

if email not verified within {say 24 hours) delete.....

I think this is more a complementary solution. Google itself enforces captchas for registration if needed. Instead of preventing the issue you are dealing with it later

you could i(i guess) also implement domain blacklisting - deny registration for yahoo.com, for example)

“so, if the user is legit, they can request a new verification email (or that flow kicks in at login) (user_verfied=false => send verfication email)” How do you achieve this? Via API and a custom software or is there a native way to do this

“personally, i just think we are living in a world where ai can break captcha” and I do agree but it’s also about resources needed to register each user. Even just having AI solving the captcha requires: 1. More skills 2. More time 3. More resources Just 2 of these are worth to have a captcha, most of the new ones are 99.9% passive for most users anyway

if i put on my black hat - i want in, and using all resources at my beck and call.

I never said it can’t be bypassed, it’s complementary, if you have 10 possible attackers with captcha and rate limit you now have 3 that wants to succeed

i havent seen it - it may need to be a custom job/api

It’s not even convenient deleting via API with custom job. You can only delete one identity at the time it looks like

for i in `select id from users where email_verified=FALSE`; do DELETE_CALL HERE; done

over simplified....

While you can do it directly via SQL you never know if the application needs to do extra stuff internally after identity deletion

i meant the sql is just the lookup to get the correct paramaters to pass to the api

Ah yes but batch deletion is not available unfortunately

that should parse as:

DELETE CALL user_id_1
DELETE CALL user_id_2

batch job but calling individual deletes