Ixnas.AltchaNet 0.1.1

Altcha.NET

Server-side implementation of the ALTCHA challenge in C#.

Features

• Compatible with the ALTCHA client-side widget
• Independent from ASP.NET (Core)
• Replay attack prevention by denying previously verified challenges
• Expiring challenges

Set up

The entrypoint of this library contains a service builder. This builder configures the service that is used to create ALTCHA challenges and validate their responses. The most basic configuration looks like this:

var altchaService = Altcha.CreateServiceBuilder()
                          .UseSha256(key)
                          .UseStore(store)
                          .Build());

Here is a description of the different configuration options.

Key

The library requires a key to sign and verify ALTCHA challenges. You can use a random number generator from .NET to create one for you:

var key = new byte[64];
using (var rng = RandomNumberGenerator.Create())
{
    rng.GetBytes(key);
}

Store

The library requires a store implementation to store previously verified challenge responses. You can use anything persistent, like a database or a file. As long as it implements the IAltchaChallengeStore interface, it will work. As an example, the bundled in-memory store (that you shouldn't use) looks like this:

internal class InMemoryStore : IAltchaChallengeStore
{
    private readonly List<string> _stored = new List<string>();

    public Task Store(string challenge, DateTimeOffset expiryUtc)
    {
        _stored.Add(challenge);
        return Task.CompletedTask;
    }

    public Task<bool> Exists(string challenge)
    {
        var exists = _stored.Contains(challenge);
        return Task.FromResult(exists);
    }
}

You can use expiryUtc to periodically remove expired challenges from your store.

Usage

Generate challenge

To generate a challenge:

var challenge = altchaService.Generate();

The challenge object can be serialized to JSON for the client to use. Read ALTCHA's documentation on how to use such a JSON object.

Validate response

To validate a response:

var validationResult = await altchaService.Validate(altchaBase64);
if (!validationResult.IsValid)
    /* ... */

The altchaBase64 parameter represents the raw value from the altcha field in a submitted form, so you don't need to convert anything.

You can run and examine the AspNetCoreExample project as a minimal example.

License

See LICENSE.txt

See LICENSE-ALTCHA.txt for ALTCHA's original license.