fix: add configurable hcaptcha timeout (#441)

* initial commit

* feat: minor fixes

* fix: directly use env var

* fix: run gofmt

* chore: remove context import

* Update test.env

* Update example.env

Co-authored-by: Joel Lee <[email protected]>

Author: J0

README.md

@@ -509,7 +509,8 @@ Whether captcha middleware is enabled
 
 for now the only option supported is: `hcaptcha`
 
-`SECURITY_CAPTCHA_SECRET` - `string`
+- `SECURITY_CAPTCHA_SECRET` - `string`
+- `SECURITY_CAPTCHA_TIMEOUT` - `string`
 
 Retrieve from hcaptcha account
 

api/middleware.go

@@ -234,6 +234,7 @@ func (a *API) verifyCaptcha(w http.ResponseWriter, req *http.Request) (context.C
 	if secret == "" {
 		return nil, internalServerError("server misconfigured")
 	}
+
 	verificationResult, err := security.VerifyRequest(req, secret)
 	if err != nil {
 		logrus.WithField("err", err).Infof("failed to validate result")

api/phone.go

@@ -30,7 +30,7 @@ func (a *API) validatePhone(phone string) (string, error) {
 	return phone, nil
 }
 
-// validateE165Format checks if phone number follows the E.164 format
+// validateE164Format checks if phone number follows the E.164 format
 func (a *API) validateE164Format(phone string) bool {
 	// match should never fail as long as regexp is valid
 	matched, _ := regexp.Match(e164Format, []byte(phone))

example.env

@@ -178,6 +178,7 @@ GOTRUE_SMS_VONAGE_FROM=""
 GOTRUE_SECURITY_CAPTCHA_ENABLED="false"
 GOTRUE_SECURITY_CAPTCHA_PROVIDER="hcaptcha"
 GOTRUE_SECURITY_CAPTCHA_SECRET="0x0000000000000000000000000000000000000000"
+GOTRUE_SECURITY_CAPTCHA_TIMEOUT="10s"
 GOTRUE_SESSION_KEY=""
 
 # SAML config

hack/test.env

@@ -94,3 +94,4 @@ GOTRUE_TRACING_TAGS="env:test"
 GOTRUE_SECURITY_CAPTCHA_ENABLED="false"
 GOTRUE_SECURITY_CAPTCHA_PROVIDER="hcaptcha"
 GOTRUE_SECURITY_CAPTCHA_SECRET="0x0000000000000000000000000000000000000000"
+GOTRUE_SECURITY_CAPTCHA_TIMEOUT="10s"

security/hcaptcha.go

@@ -5,8 +5,10 @@ import (
 	"encoding/json"
 	"fmt"
 	"io/ioutil"
+	"log"
 	"net/http"
 	"net/url"
+	"os"
 	"strconv"
 	"strings"
 	"time"
@@ -40,8 +42,17 @@ const (
 var Client *http.Client
 
 func init() {
-	// TODO (darora): make timeout configurable
-	Client = &http.Client{Timeout: 10 * time.Second}
+	var defaultTimeout time.Duration = time.Second * 10
+	timeoutStr := os.Getenv("GOTRUE_SECURITY_CAPTCHA_TIMEOUT")
+	if timeoutStr != "" {
+		if timeout, err := time.ParseDuration(timeoutStr); err != nil {
+			log.Fatalf("error loading GOTRUE_SECURITY_CAPTCHA_TIMEOUT: %v", err.Error())
+		} else if timeout != 0 {
+			defaultTimeout = timeout
+		}
+	}
+
+	Client = &http.Client{Timeout: defaultTimeout}
 }
 
 func VerifyRequest(r *http.Request, secretKey string) (VerificationResult, error) {