0 Releases 43 Tags

RSS Feed

• v0.18.2 8bd92ea5c4

  feat(captcha): single-use verification tokens (replay hardening)

  Ghost released this 2026-07-04 04:32:52 +00:00 | 17 commits to main since this release

  VerifyToken now consumes a redemption token on its first successful verify:
  a replayed token within its 5-min TTL is rejected. Mirrors the existing
  single-use challenge-nonce store with a per-Server used-token store keyed on
  the token's random id, same GC/expiry approach (entries live only for the
  remaining TTL). The token is burned only on a successful verify (valid HMAC +
  unexpired + unused); forged/expired tokens never touch the store.

  Co-Authored-By: Claude Fable 5 noreply@anthropic.com

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)