Добавлена Яндекс.Капча

2026-07-23 18:53:32 +03:00
parent 31efbf3b69
commit 8c3c454998
36 changed files with 836 additions and 35 deletions
@@ -31,6 +31,20 @@ The Maven build shades only libphonenumber into the provider JAR; Keycloak SPI d

 Copy values from `.env.example` into the root backend `.env`; never commit `.env`. Generate independent random values for admin password, mock code, OTP HMAC key and settings bridge token.

+### Yandex SmartCaptcha
+
+Invisible SmartCaptcha protects every operation that orders an OTP SMS, including resend. It is disabled by default. To enable it, create one CAPTCHA in Yandex Cloud, add the public login hostname (without `https://`) to allowed sites and set:
+
+```env
+KEYCLOAK_YANDEX_CAPTCHA_ENABLED=true
+KEYCLOAK_YANDEX_CAPTCHA_CLIENT_KEY=<public-client-key>
+KEYCLOAK_YANDEX_CAPTCHA_SERVER_KEY=<secret-server-key>
+```
+
+The browser token is validated by Keycloak before `OtpFlow.start()`. A provider rejection, missing token or non-temporary HTTP 4xx denies the SMS order. Timeout, I/O, HTTP 408/429/5xx and malformed provider responses are logged without token/phone/keys and handled fail-open. Tokens are one-time and a resend always executes a fresh CAPTCHA.
+
+SmartCaptcha CSP is applied only by nginx to the `han-chat` login and login-action endpoints. Never set a custom `browserSecurityHeaders.contentSecurityPolicy` in the realm: it can break Keycloak Admin Console and third-party cookie iframes.
+
 Before production deployment replace the explicit placeholder entries in `realm/han-chat-realm.json`:

 - `https://APP_LINK_HOST.example/auth/callback`