Invisible reCAPTCHA Integration with Laravel

 

Invisible reCAPTCHA is an improved version of reCAPTCHA v2 (No CAPTCHA) developed by Google, and users now only need to click the button: “I’m not a robot” to prove they are human.

In Invisible reCAPTCHA, there is no longer an embedded CAPTCHA box for users to interact with. It’s totally invisible with only a badge showing on the bottom of the page so users your website know you are using this technology. (The badge can be hidden, but this is not recommended.)

Here is an example what it looks like if you’re using Invisible reCAPTCHA:

I created a simple package to help you integrate Invisible reCAPTCHA into your Laravel projects quickly and easily!

Invisible reCAPTCHA Installation

composer require albertcht/invisible-recaptcha

Next, add the ServiceProvider to the providers array in app/config/app.php.

AlbertCht\InvisibleReCaptcha\InvisibleReCaptchaServiceProvider::class,

Configuration

Before you set your config, you need to apply for your API keys on https://www.google.com/recaptcha/admin first.

While choosing the type of your reCAPTCHA, remember to choose invisible reCAPTCHA to make it work in the background.

After you’ve registered a new site, take your keys and add them to your .env file:

INVISIBLE_RECAPTCHA_SITEKEY={siteKey}
INVISIBLE_RECAPTCHA_SECRETKEY={secretKey}
INVISIBLE_RECAPTCHA_BADGEHIDE=false
INVISIBLE_RECAPTCHA_DEBUG=false

If you set INVISIBLE_RECAPTCHA_BADGEHIDE to true, you can hide the badge logo.

You can see the binding status of those CAPTCHA elements on browser console by setting INVISIBLE_RECAPTCHA_DEBUG as true.

reCAPTCHA Usage

Display reCAPTCHA in Your View

{!! app('captcha')->render(); !!}

With custom language support:

{!! app('captcha')->render($lang = null); !!}

Validation

Add 'g-recaptcha-response' => 'required|captcha' to rules array.

<br></br>$validate = Validator::make(Input::all(), [
    'g-recaptcha-response' => 'required|captcha'
]);

Check out the invisible-recaptcha package for the documentation and code.

Read More

Partyline is a new package that allows you to output to the console from outside of command class. This allows you more control on how things are printed and is great for when you need to loop items and show progress or other insights.

Here is an example of a normal Command’s handle method that I grabbed from their announcement:

// Console command without Partyline
public function handle()
{
    $this->line('Updating the index...');

    Search::update(); // ¯\_(ツ)_/¯

    $this->line('Surprise! It is finished!');
}

Inside the Search update() method it’s difficult to pass back feedback and with Partyline this can now include the following:

class Search
{
    public function update()
    {
        Partyline::line('Updating the index...');

        $entries = Entry::all();

        $bar = Partyline::getOutput()->createProgressBar($entries->count());

        foreach ($entries as $id => $entry) {
            $this->index->insert($id, $entry);
            $bar->advance();
        }

        $bar->finish();
        Partyline::line('All done!');
    }
}

Check out the annoncement and the Github repo for more details on this package.

Read More

Bring Laravel Collections to JavaScript with Collect.js

Collect.js is a port of Laravel Collections to JavaScript. It’s dependency free and makes working with arrays and objects easy.

Here is an example of utilizing the where method:

const collection = collect([
  {'product': 'Desk', 'price': 200},
  {'product': 'Chair', 'price': 100},
  {'product': 'Bookcase', 'price': 150},
  {'product': 'Door', 'price': '100'},
]);

const filtered = collection.where('price', 100);

filtered.all();

//=> [
//=>   {'product': 'Chair', 'price': 100},
//=>   {'product': 'Door', 'price': '100'}
//=> ]

As you can see, it’s almost a one to one map with the Laravel version and it even includes the fairly new Collection Tap method but it does have some differences when dealing with comparisons:

All comparisons in collect.js are done using strict equality. Using loose equality comparisons are generally frowned upon in JavaScript. Laravel only performs “loose” comparisons by default and offer several “strict” comparison methods. These methods have not been implemented in collect.js because all methods are strict by default.

You can install Collect.js through NPM.

npm install collect.js




Read More

Homeboy Allows You to Automate Adding Sites to Homestead

 

Homeboy is a new package for Laravel Homestead that allows you to add a new local development site quickly. Once you run the command line tool, it will update your host file to point your dev domain, update your Homestead.yaml file to include mapping to for the new project and create a database mapping, and finally, it’ll re-provision Vagrant.

Here is a video they put together showing it in action:

A tool like Homeboy is useful if you have a lot of projects in development and makes using Homestead almost as seamless as Valet. You can find out more about Homeboy and installation instructions from the Github repo.

Read More

Bouncer a Laravel Package for Role and Ability Authorization

Bouncer is an authorization package by Joseph Silber which allows role and ability checks at Laravel’s authorization gate. The package is described as follows:

Bouncer provides a mechanism to handle roles and abilities in Laravel’s ACL. With an expressive and fluent syntax, it stays out of your way as much as possible: use it when you want, ignore it when you don’t.

Bouncer makes it trivial to quickly create roles and abilities with a fluent API that creates them automatically.

Bouncer::allow('admin')->to('ban-users');

You can optionally add the HasRolesAndAbilities trait to the User model. This trait allows you to assign roles and abilities, and check them with in the model.

use Silber\Bouncer\Database\HasRolesAndAbilities;

class User extends Authenticatable
{
    use Notifiable,
        HasRolesAndAbilities;
}

When you assign a role that hasn’t been created yet, Bouncer will do it automatically.

$user->assign('admin');

As a quick example, imagine a database seeder that creates a few roles with Bouncer and assigns users to a role using the HasRolesAndAbilities trait.

public function run()
{
    \Bouncer::allow('admin')->toManage(Post::class);
    \Bouncer::allow('editor')->to('update', \App\Post::class);

    $admin = factory(App\User::class)->create([
        'email' => 'admin@example.com'
    ]);

    $admin->assign('admin');

    $editor = factory(App\User::class)->create([
        'email' => 'editor@example.com'
    ]);

    $editor->assign('editor');

    factory(App\User::class)->create([
        'email' => 'user@example.com'
    ]);
}

The database seeder conveniently creates two roles: admin and editor. The admin will have permission to all post abilities on the App\Post model. The editor role only has the update ability.

With the above roles, abilities, and users, we can define a route and protect updating a Post using Laravel’s Authorize middleware.

Route::get('/posts/{post}', 'PostsController@show')
        ->name('post.update')
    ->middleware('can:update,post');

Both authenticated administrators and editors will be able to see a post, guests will be redirected to login, and authenticated users lacking the update ability will get a 403 Forbidden response.

In the view, you can use Laravel’s @can directive to check for abilities and Bouncer will intercept the check and authorize it if an ability has been granted to the user.

@can ('update', $post)
    <a href="{{ route('post.update', $post) }}">Edit Post</a>
@endcan

Not only can you grant user abilities through roles, but you can also assign an ability directly to a user.

$post = \App\Post::first();
$normalUser = \App\User::find('email', 'user@example.com')->first();

// Only update a specific post, perhaps one this user submitted.
$normalUser->allow('update', $post)

// Ability to update all posts directly on a user
$normalUser->allow('update', \App\Post::class);

Bouncer provides methods for checking user roles, but the Bouncer documentation warns against role checking directly:

Generally speaking, you should not have a need to check roles directly. It is better to allow a role certain abilities, then check for those abilities instead. If what you need is very general, you can create very broad abilities. For example, an access-dashboard ability is always better than checking for admin or editor roles directly.

Last, if you want to get a user’s abilities, call $user->getAbilities(), which returns a database collection:

Check out the package’s readme to learn how to install and use Bouncer. The cheat sheet is handy for a quick overview of the package’s API and capabilities.

Read More