Alex Dunmow 742f4434b1 feat(captcha): SetSecret for live HMAC secret rotation ...

Server now holds the secret in an atomic.Pointer so a running instance can
swap it; outstanding challenge and verification tokens signed with the old
secret immediately fail verification.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-20 14:20:43 +08:00

..

captcha_test.go

feat(captcha): single-use verification tokens (replay hardening)

2026-07-04 12:32:52 +08:00

captcha.go

feat(captcha): SetSecret for live HMAC secret rotation

2026-07-20 14:20:43 +08:00

nonce_test.go

feat(captcha): in-process nonce store for single-use enforcement

2026-07-03 17:16:19 +08:00

nonce.go

feat(captcha): in-process nonce store for single-use enforcement

2026-07-03 17:16:19 +08:00

prng_test.go

feat(captcha): FNV-1a + xorshift32 PRNG matching Cap.js widget

2026-07-03 17:12:04 +08:00

prng.go

feat(captcha): FNV-1a + xorshift32 PRNG matching Cap.js widget

2026-07-03 17:12:04 +08:00

tokens_test.go

feat(captcha): HMAC-signed stateless challenge + verification tokens

2026-07-03 17:13:24 +08:00

tokens.go

feat(captcha): single-use verification tokens (replay hardening)

2026-07-04 12:32:52 +08:00