A Symfony bundle for integrating Google reCAPTCHA v3 to protect forms and APIs from bots without user interaction.
KarserRecaptcha3Bundle is a Symfony bundle that integrates Google reCAPTCHA v3 to protect web applications from bots and automated abuse. It provides invisible verification that scores user interactions without interrupting the user experience, allowing developers to block suspicious activity while maintaining usability.
Symfony developers building forms or APIs that need protection against spam, bots, and automated attacks without requiring user interaction like traditional CAPTCHAs.
Developers choose this bundle because it offers a Symfony-native, well-documented solution with extensive configuration options, testing support, and flexibility for both forms and APIs—saving time compared to building custom reCAPTCHA integrations.
Google ReCAPTCHA v3 for Symfony
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Provides a Recaptcha3Type form field with built-in validation constraints, seamlessly fitting into Symfony's form and validation systems as shown in the form building examples.
Supports validating reCAPTCHA tokens in API requests through DTOs and validation constraints, enabling bot protection beyond traditional forms with frontend integration examples.
Allows disabling reCAPTCHA in test environments via a simple configuration flag (enabled: false), and supports dynamic score thresholds through PHP code for custom logic.
Configurable host option to use 'www.recaptcha.net' as an alternative, ensuring compatibility in regions where Google is blocked, as detailed in the configuration section.
Relies entirely on Google's reCAPTCHA API, introducing third-party risk and potential issues with data privacy regulations, which the bundle does not mitigate.
Handling proxies like Cloudflare requires custom IP resolver implementations and service decoration, adding development overhead as shown in the lengthy example code.
Needs client-side JavaScript to fetch tokens, making it unsuitable for applications that must function without JavaScript or require server-side-only validation.