stages/captcha: customisable URLs (#3832)

* make api and js url customisable Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * use recaptcha.net domains Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * add form Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> * regen locale Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org> Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
2022-12-18 15:18:43 +02:00 · 2022-12-18 15:18:43 +02:00 · ec925491b2
parent 2d18c1bb6f
commit ec925491b2
18 changed files with 360 additions and 75 deletions
--- a/authentik/stages/captcha/api.py
+++ b/authentik/stages/captcha/api.py
@ -12,7 +12,7 @@ class CaptchaStageSerializer(StageSerializer):
    class Meta:

        model = CaptchaStage
-        fields = StageSerializer.Meta.fields + ["public_key", "private_key"]
+        fields = StageSerializer.Meta.fields + ["public_key", "private_key", "js_url", "api_url"]
        extra_kwargs = {"private_key": {"write_only": True}}


--- a/authentik/stages/captcha/migrations/0002_captchastage_api_url_captchastage_js_url_and_more.py
+++ b/authentik/stages/captcha/migrations/0002_captchastage_api_url_captchastage_js_url_and_more.py
@ -0,0 +1,33 @@
+# Generated by Django 4.1.2 on 2022-10-20 19:30
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("authentik_stages_captcha", "0001_initial"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="captchastage",
+            name="api_url",
+            field=models.TextField(default="https://www.recaptcha.net/recaptcha/api/siteverify"),
+        ),
+        migrations.AddField(
+            model_name="captchastage",
+            name="js_url",
+            field=models.TextField(default="https://www.recaptcha.net/recaptcha/api.js"),
+        ),
+        migrations.AlterField(
+            model_name="captchastage",
+            name="private_key",
+            field=models.TextField(help_text="Private key, acquired your captcha Provider."),
+        ),
+        migrations.AlterField(
+            model_name="captchastage",
+            name="public_key",
+            field=models.TextField(help_text="Public key, acquired your captcha Provider."),
+        ),
+    ]
--- a/authentik/stages/captcha/models.py
+++ b/authentik/stages/captcha/models.py
@ -11,12 +11,11 @@ from authentik.flows.models import Stage
 class CaptchaStage(Stage):
    """Verify the user is human using Google's reCaptcha."""

-    public_key = models.TextField(
-        help_text=_("Public key, acquired from https://www.google.com/recaptcha/intro/v3.html")
-    )
-    private_key = models.TextField(
-        help_text=_("Private key, acquired from https://www.google.com/recaptcha/intro/v3.html")
-    )
+    public_key = models.TextField(help_text=_("Public key, acquired your captcha Provider."))
+    private_key = models.TextField(help_text=_("Private key, acquired your captcha Provider."))
+
+    js_url = models.TextField(default="https://www.recaptcha.net/recaptcha/api.js")
+    api_url = models.TextField(default="https://www.recaptcha.net/recaptcha/api/siteverify")

    @property
    def serializer(self) -> type[BaseSerializer]:
--- a/authentik/stages/captcha/stage.py
+++ b/authentik/stages/captcha/stage.py
@ -20,6 +20,7 @@ class CaptchaChallenge(WithUserInfoChallenge):
    """Site public key"""

    site_key = CharField()
+    js_url = CharField(read_only=True)
    component = CharField(default="ak-stage-captcha")


@ -34,7 +35,7 @@ class CaptchaChallengeResponse(ChallengeResponse):
        stage: CaptchaStage = self.stage.executor.current_stage
        try:
            response = get_http_session().post(
-                "https://www.google.com/recaptcha/api/siteverify",
+                stage.api_url,
                headers={
                    "Content-type": "application/x-www-form-urlencoded",
                },
@ -61,6 +62,7 @@ class CaptchaStageView(ChallengeStageView):
    def get_challenge(self, *args, **kwargs) -> Challenge:
        return CaptchaChallenge(
            data={
+                "js_url": self.executor.current_stage.js_url,
                "type": ChallengeTypes.NATIVE.value,
                "site_key": self.executor.current_stage.public_key,
            }
--- a/locale/en/LC_MESSAGES/django.po
+++ b/locale/en/LC_MESSAGES/django.po
@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2022-12-12 16:22+0000\n"
+"POT-Creation-Date: 2022-12-15 15:01+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@ -1555,21 +1555,19 @@ msgstr ""
 msgid "WebAuthn Devices"
 msgstr ""

+#: authentik/stages/captcha/models.py:14
+msgid "Public key, acquired your captcha Provider."
+msgstr ""
+
 #: authentik/stages/captcha/models.py:15
-msgid ""
-"Public key, acquired from https://www.google.com/recaptcha/intro/v3.html"
+msgid "Private key, acquired your captcha Provider."
 msgstr ""

-#: authentik/stages/captcha/models.py:18
-msgid ""
-"Private key, acquired from https://www.google.com/recaptcha/intro/v3.html"
-msgstr ""
-
-#: authentik/stages/captcha/models.py:39
+#: authentik/stages/captcha/models.py:38
 msgid "Captcha Stage"
 msgstr ""

-#: authentik/stages/captcha/models.py:40
+#: authentik/stages/captcha/models.py:39
 msgid "Captcha Stages"
 msgstr ""

@ -1897,7 +1895,7 @@ msgstr ""
 msgid "No Pending user to login."
 msgstr ""

-#: authentik/stages/user_login/stage.py:55
+#: authentik/stages/user_login/stage.py:58
 msgid "Successfully logged in!"
 msgstr ""

--- a/schema.yml
+++ b/schema.yml
@ -26175,7 +26175,11 @@ components:
          type: string
        site_key:
          type: string
+        js_url:
+          type: string
+          readOnly: true
      required:
+      - js_url
      - pending_user
      - pending_user_avatar
      - site_key
@ -26222,7 +26226,11 @@ components:
            $ref: '#/components/schemas/FlowSet'
        public_key:
          type: string
-          description: Public key, acquired from https://www.google.com/recaptcha/intro/v3.html
+          description: Public key, acquired your captcha Provider.
+        js_url:
+          type: string
+        api_url:
+          type: string
      required:
      - component
      - meta_model_name
@ -26245,12 +26253,18 @@ components:
        public_key:
          type: string
          minLength: 1
-          description: Public key, acquired from https://www.google.com/recaptcha/intro/v3.html
+          description: Public key, acquired your captcha Provider.
        private_key:
          type: string
          writeOnly: true
          minLength: 1
-          description: Private key, acquired from https://www.google.com/recaptcha/intro/v3.html
+          description: Private key, acquired your captcha Provider.
+        js_url:
+          type: string
+          minLength: 1
+        api_url:
+          type: string
+          minLength: 1
      required:
      - name
      - private_key
@ -33384,12 +33398,18 @@ components:
        public_key:
          type: string
          minLength: 1
-          description: Public key, acquired from https://www.google.com/recaptcha/intro/v3.html
+          description: Public key, acquired your captcha Provider.
        private_key:
          type: string
          writeOnly: true
          minLength: 1
-          description: Private key, acquired from https://www.google.com/recaptcha/intro/v3.html
+          description: Private key, acquired your captcha Provider.
+        js_url:
+          type: string
+          minLength: 1
+        api_url:
+          type: string
+          minLength: 1
    PatchedCertificateKeyPairRequest:
      type: object
      description: CertificateKeyPair Serializer
--- a/web/src/admin/stages/captcha/CaptchaStageForm.ts
+++ b/web/src/admin/stages/captcha/CaptchaStageForm.ts
@ -43,7 +43,7 @@ export class CaptchaStageForm extends ModelForm<CaptchaStage, string> {
    renderForm(): TemplateResult {
        return html`<form class="pf-c-form pf-m-horizontal">
            <div class="form-help-text">
-                ${t`This stage checks the user's current session against the Google reCaptcha service.`}
+                ${t`This stage checks the user's current session against the Google reCaptcha (or compatible) service.`}
            </div>
            <ak-form-element-horizontal label=${t`Name`} ?required=${true} name="name">
                <input
@ -84,6 +84,39 @@ export class CaptchaStageForm extends ModelForm<CaptchaStage, string> {
                    </ak-form-element-horizontal>
                </div>
            </ak-form-group>
+            <ak-form-group>
+                <span slot="header"> ${t`Advanced settings`} </span>
+                <div slot="body" class="pf-c-form">
+                    <ak-form-element-horizontal label=${t`JS URL`} ?required=${true} name="jsUrl">
+                        <input
+                            type="text"
+                            value="${ifDefined(
+                                this.instance?.jsUrl ||
+                                    "https://www.recaptcha.net/recaptcha/api.js",
+                            )}"
+                            class="pf-c-form-control"
+                            required
+                        />
+                        <p class="pf-c-form__helper-text">
+                            ${t`URL to fetch JavaScript from, defaults to recaptcha. Can be replaced with any compatible alternative.`}
+                        </p>
+                    </ak-form-element-horizontal>
+                    <ak-form-element-horizontal label=${t`API URL`} ?required=${true} name="apiUrl">
+                        <input
+                            type="text"
+                            value="${ifDefined(
+                                this.instance?.apiUrl ||
+                                    "https://www.recaptcha.net/recaptcha/api/siteverify",
+                            )}"
+                            class="pf-c-form-control"
+                            required
+                        />
+                        <p class="pf-c-form__helper-text">
+                            ${t`URL used to validate captcha response, defaults to recaptcha. Can be replaced with any compatible alternative.`}
+                        </p>
+                    </ak-form-element-horizontal>
+                </div>
+            </ak-form-group>
        </form>`;
    }
 }
--- a/web/src/flow/stages/captcha/CaptchaStage.ts
+++ b/web/src/flow/stages/captcha/CaptchaStage.ts
@ -28,7 +28,7 @@ export class CaptchaStage extends BaseStage<CaptchaChallenge, CaptchaChallengeRe

    firstUpdated(): void {
        const script = document.createElement("script");
-        script.src = "https://www.google.com/recaptcha/api.js";
+        script.src = this.challenge.jsUrl;
        script.async = true;
        script.defer = true;
        const captchaContainer = document.createElement("div");
--- a/web/src/locales/de.po
+++ b/web/src/locales/de.po
@ -181,6 +181,10 @@ msgstr "API Anfragen"
 msgid "API Token (can be used to access the API programmatically)"
 msgstr "API Token (kann für den Zugriff auf die API verwendet werden)"

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "API URL"
+msgstr ""
+
 #: src/elements/messages/Middleware.ts
 msgid "API request failed"
 msgstr "API Anfrage fehlgeschlagen"
@ -347,9 +351,9 @@ msgstr "Admin Interface"
 msgid "Advanced protocol settings"
 msgstr "Erweiterte Protokolleinstellungen"

-#: src/admin/policies/password/PasswordPolicyForm.ts
-#~ msgid "Advanced settings"
-#~ msgstr "Erweiterte Einstellungen"
+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "Advanced settings"
+msgstr "Erweiterte Einstellungen"

 #: src/admin/events/EventInfo.ts
 msgid "Affected model:"
@ -3033,6 +3037,10 @@ msgstr "Aussteller"
 msgid "Issuer mode"
 msgstr "Ausstellermodus"

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "JS URL"
+msgstr ""
+
 #: src/admin/sources/oauth/OAuthSourceForm.ts
 msgid "JSON Web Key URL. Keys from the URL will be used to validate JWTs from this source."
 msgstr ""
@ -6096,8 +6104,12 @@ msgid "This stage can be included in enrollment flows to accept invitations."
 msgstr "Diese Phase kann in Registrierungsabläufe aufgenommen werden, um Einladungen anzunehmen."

 #: src/admin/stages/captcha/CaptchaStageForm.ts
-msgid "This stage checks the user's current session against the Google reCaptcha service."
-msgstr "In dieser Phase wird die aktuelle Sitzung des Benutzers mit dem Google reCaptcha-Dienst verglichen."
+msgid "This stage checks the user's current session against the Google reCaptcha (or compatible) service."
+msgstr ""
+
+#: src/admin/stages/captcha/CaptchaStageForm.ts
+#~ msgid "This stage checks the user's current session against the Google reCaptcha service."
+#~ msgstr "In dieser Phase wird die aktuelle Sitzung des Benutzers mit dem Google reCaptcha-Dienst verglichen."

 #: src/admin/policies/reputation/ReputationPolicyForm.ts
 msgid "Threshold"
@ -6323,6 +6335,10 @@ msgstr "URL, an die die erste Login-Anfrage gesendet wird."
 msgid "URL the user is redirect to to consent the authorization."
 msgstr "URL, zu der Benutzer weitergeleitet werden um die Authorisierung zu bestätigen."

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "URL to fetch JavaScript from, defaults to recaptcha. Can be replaced with any compatible alternative."
+msgstr ""
+
 #: src/admin/sources/oauth/OAuthSourceForm.ts
 msgid "URL used by authentik to get user information."
 msgstr "URL, die von Authentik verwendet wird, um Benutzerinformationen zu erhalten."
@ -6335,6 +6351,10 @@ msgstr "URL, die von Authentik zum Abrufen von Token verwendet wird."
 msgid "URL used to request the initial token. This URL is only required for OAuth 1."
 msgstr "URL, die zur Anforderung des anfänglichen Tokens verwendet wird. Diese URL ist nur für OAuth 1 erforderlich"

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "URL used to validate captcha response, defaults to recaptcha. Can be replaced with any compatible alternative."
+msgstr ""
+
 #: src/admin/applications/wizard/link/TypeLinkApplicationWizardPage.ts
 msgid "URL which will be opened when a user clicks on the application."
 msgstr ""
--- a/web/src/locales/en.po
+++ b/web/src/locales/en.po
@ -159,6 +159,10 @@ msgstr "API Requests"
 msgid "API Token (can be used to access the API programmatically)"
 msgstr "API Token (can be used to access the API programmatically)"

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "API URL"
+msgstr "API URL"
+
 #: src/elements/messages/Middleware.ts
 msgid "API request failed"
 msgstr "API request failed"
@ -329,9 +333,9 @@ msgstr "Admin interface"
 msgid "Advanced protocol settings"
 msgstr "Advanced protocol settings"

-#: src/admin/policies/password/PasswordPolicyForm.ts
-#~ msgid "Advanced settings"
-#~ msgstr "Advanced settings"
+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "Advanced settings"
+msgstr "Advanced settings"

 #: src/admin/events/EventInfo.ts
 msgid "Affected model:"
@ -3084,6 +3088,10 @@ msgstr "Issuer"
 msgid "Issuer mode"
 msgstr "Issuer mode"

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "JS URL"
+msgstr "JS URL"
+
 #: src/admin/sources/oauth/OAuthSourceForm.ts
 msgid "JSON Web Key URL. Keys from the URL will be used to validate JWTs from this source."
 msgstr "JSON Web Key URL. Keys from the URL will be used to validate JWTs from this source."
@ -6238,8 +6246,12 @@ msgid "This stage can be included in enrollment flows to accept invitations."
 msgstr "This stage can be included in enrollment flows to accept invitations."

 #: src/admin/stages/captcha/CaptchaStageForm.ts
-msgid "This stage checks the user's current session against the Google reCaptcha service."
-msgstr "This stage checks the user's current session against the Google reCaptcha service."
+msgid "This stage checks the user's current session against the Google reCaptcha (or compatible) service."
+msgstr "This stage checks the user's current session against the Google reCaptcha (or compatible) service."
+
+#: src/admin/stages/captcha/CaptchaStageForm.ts
+#~ msgid "This stage checks the user's current session against the Google reCaptcha service."
+#~ msgstr "This stage checks the user's current session against the Google reCaptcha service."

 #: src/admin/policies/reputation/ReputationPolicyForm.ts
 msgid "Threshold"
@ -6471,6 +6483,10 @@ msgstr "URL that the initial Login request is sent to."
 msgid "URL the user is redirect to to consent the authorization."
 msgstr "URL the user is redirect to to consent the authorization."

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "URL to fetch JavaScript from, defaults to recaptcha. Can be replaced with any compatible alternative."
+msgstr "URL to fetch JavaScript from, defaults to recaptcha. Can be replaced with any compatible alternative."
+
 #: src/admin/sources/oauth/OAuthSourceForm.ts
 msgid "URL used by authentik to get user information."
 msgstr "URL used by authentik to get user information."
@ -6483,6 +6499,10 @@ msgstr "URL used by authentik to retrieve tokens."
 msgid "URL used to request the initial token. This URL is only required for OAuth 1."
 msgstr "URL used to request the initial token. This URL is only required for OAuth 1."

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "URL used to validate captcha response, defaults to recaptcha. Can be replaced with any compatible alternative."
+msgstr "URL used to validate captcha response, defaults to recaptcha. Can be replaced with any compatible alternative."
+
 #: src/admin/applications/wizard/link/TypeLinkApplicationWizardPage.ts
 msgid "URL which will be opened when a user clicks on the application."
 msgstr "URL which will be opened when a user clicks on the application."
--- a/web/src/locales/es.po
+++ b/web/src/locales/es.po
@ -165,6 +165,10 @@ msgstr "Solicitudes de API"
 msgid "API Token (can be used to access the API programmatically)"
 msgstr "Token de API (se puede usar para acceder a la API mediante programación)"

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "API URL"
+msgstr ""
+
 #: src/elements/messages/Middleware.ts
 msgid "API request failed"
 msgstr "Solicitud de API fallida"
@ -325,9 +329,9 @@ msgstr "Interfaz de administración"
 msgid "Advanced protocol settings"
 msgstr "Configuraciones de protocolo avanzada"

-#: src/admin/policies/password/PasswordPolicyForm.ts
-#~ msgid "Advanced settings"
-#~ msgstr "Configuraciones avanzadas"
+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "Advanced settings"
+msgstr "Configuraciones avanzadas"

 #: src/admin/events/EventInfo.ts
 msgid "Affected model:"
@ -3009,6 +3013,10 @@ msgstr "Emisor"
 msgid "Issuer mode"
 msgstr "Modo emisor"

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "JS URL"
+msgstr ""
+
 #: src/admin/sources/oauth/OAuthSourceForm.ts
 msgid "JSON Web Key URL. Keys from the URL will be used to validate JWTs from this source."
 msgstr ""
@ -6072,8 +6080,12 @@ msgid "This stage can be included in enrollment flows to accept invitations."
 msgstr "Esta etapa se puede incluir en los flujos de inscripción para aceptar invitaciones."

 #: src/admin/stages/captcha/CaptchaStageForm.ts
-msgid "This stage checks the user's current session against the Google reCaptcha service."
-msgstr "En esta etapa, se comprueba la sesión actual del usuario con el servicio Google reCAPTCHA."
+msgid "This stage checks the user's current session against the Google reCaptcha (or compatible) service."
+msgstr ""
+
+#: src/admin/stages/captcha/CaptchaStageForm.ts
+#~ msgid "This stage checks the user's current session against the Google reCaptcha service."
+#~ msgstr "En esta etapa, se comprueba la sesión actual del usuario con el servicio Google reCAPTCHA."

 #: src/admin/policies/reputation/ReputationPolicyForm.ts
 msgid "Threshold"
@ -6299,6 +6311,10 @@ msgstr "URL a la que se envía la solicitud de inicio de sesión inicial."
 msgid "URL the user is redirect to to consent the authorization."
 msgstr "URL a la que se redirige al usuario para dar su consentimiento a la autorización."

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "URL to fetch JavaScript from, defaults to recaptcha. Can be replaced with any compatible alternative."
+msgstr ""
+
 #: src/admin/sources/oauth/OAuthSourceForm.ts
 msgid "URL used by authentik to get user information."
 msgstr "URL utilizada por authentik para obtener información del usuario."
@ -6311,6 +6327,10 @@ msgstr "URL utilizada por authentik para recuperar tokens."
 msgid "URL used to request the initial token. This URL is only required for OAuth 1."
 msgstr "URL utilizada para solicitar el token inicial. Esta URL solo es necesaria para OAuth 1."

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "URL used to validate captcha response, defaults to recaptcha. Can be replaced with any compatible alternative."
+msgstr ""
+
 #: src/admin/applications/wizard/link/TypeLinkApplicationWizardPage.ts
 msgid "URL which will be opened when a user clicks on the application."
 msgstr ""
--- a/web/src/locales/fr_FR.po
+++ b/web/src/locales/fr_FR.po
@ -170,6 +170,10 @@ msgstr "Requêtes d'API"
 msgid "API Token (can be used to access the API programmatically)"
 msgstr "Jeton d'API (peut être utilisé pour accéder à l'API via un programme)"

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "API URL"
+msgstr ""
+
 #: src/elements/messages/Middleware.ts
 msgid "API request failed"
 msgstr "Requête d'API échouée"
@ -330,9 +334,9 @@ msgstr "Interface d'administration"
 msgid "Advanced protocol settings"
 msgstr "Paramètres avancés"

-#: src/admin/policies/password/PasswordPolicyForm.ts
-#~ msgid "Advanced settings"
-#~ msgstr "Paramètres avancés"
+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "Advanced settings"
+msgstr "Paramètres avancés"

 #: src/admin/events/EventInfo.ts
 msgid "Affected model:"
@ -3010,6 +3014,10 @@ msgstr "Émetteur"
 msgid "Issuer mode"
 msgstr "Mode de l'émetteur"

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "JS URL"
+msgstr ""
+
 #: src/admin/sources/oauth/OAuthSourceForm.ts
 msgid "JSON Web Key URL. Keys from the URL will be used to validate JWTs from this source."
 msgstr ""
@ -6063,8 +6071,12 @@ msgid "This stage can be included in enrollment flows to accept invitations."
 msgstr "Cette étape peut être incluse dans les flux d'inscription pour accepter les invitations."

 #: src/admin/stages/captcha/CaptchaStageForm.ts
-msgid "This stage checks the user's current session against the Google reCaptcha service."
-msgstr "Cette étape vérifie la session actuelle de l'utilisateur sur le service reCaptcha de Google."
+msgid "This stage checks the user's current session against the Google reCaptcha (or compatible) service."
+msgstr ""
+
+#: src/admin/stages/captcha/CaptchaStageForm.ts
+#~ msgid "This stage checks the user's current session against the Google reCaptcha service."
+#~ msgstr "Cette étape vérifie la session actuelle de l'utilisateur sur le service reCaptcha de Google."

 #: src/admin/policies/reputation/ReputationPolicyForm.ts
 msgid "Threshold"
@ -6290,6 +6302,10 @@ msgstr "URL de destination de la requête initiale de login."
 msgid "URL the user is redirect to to consent the authorization."
 msgstr "URL vers laquelle l'utilisateur est redirigé pour consentir l'autorisation."

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "URL to fetch JavaScript from, defaults to recaptcha. Can be replaced with any compatible alternative."
+msgstr ""
+
 #: src/admin/sources/oauth/OAuthSourceForm.ts
 msgid "URL used by authentik to get user information."
 msgstr "URL utilisée par authentik pour obtenir des informations sur l'utilisateur."
@ -6302,6 +6318,10 @@ msgstr "URL utilisée par authentik pour récupérer les jetons."
 msgid "URL used to request the initial token. This URL is only required for OAuth 1."
 msgstr "URL utilisée pour demander le jeton initial. Cette URL est uniquement requise pour OAuth 1."

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "URL used to validate captcha response, defaults to recaptcha. Can be replaced with any compatible alternative."
+msgstr ""
+
 #: src/admin/applications/wizard/link/TypeLinkApplicationWizardPage.ts
 msgid "URL which will be opened when a user clicks on the application."
 msgstr ""
--- a/web/src/locales/pl.po
+++ b/web/src/locales/pl.po
@ -165,6 +165,10 @@ msgstr "Żądania API"
 msgid "API Token (can be used to access the API programmatically)"
 msgstr "Token API (może być używany do programowego dostępu do API)"

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "API URL"
+msgstr ""
+
 #: src/elements/messages/Middleware.ts
 msgid "API request failed"
 msgstr "Żądanie API nie powiodło się"
@ -329,9 +333,9 @@ msgstr "Interfejs administratora"
 msgid "Advanced protocol settings"
 msgstr "Zaawansowane ustawienia protokołu"

-#: src/admin/policies/password/PasswordPolicyForm.ts
-#~ msgid "Advanced settings"
-#~ msgstr "Zaawansowane ustawienia"
+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "Advanced settings"
+msgstr "Zaawansowane ustawienia"

 #: src/admin/events/EventInfo.ts
 msgid "Affected model:"
@ -3017,6 +3021,10 @@ msgstr "Wystawca"
 msgid "Issuer mode"
 msgstr "Tryb wystawcy"

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "JS URL"
+msgstr ""
+
 #: src/admin/sources/oauth/OAuthSourceForm.ts
 msgid "JSON Web Key URL. Keys from the URL will be used to validate JWTs from this source."
 msgstr "JSON Web Key URL. Klucze z adresu URL będą używane do walidacji tokenów JWT z tego źródła."
@ -6082,8 +6090,12 @@ msgid "This stage can be included in enrollment flows to accept invitations."
 msgstr "Ten etap można uwzględnić w przepływach rejestracji, aby akceptować zaproszenia."

 #: src/admin/stages/captcha/CaptchaStageForm.ts
-msgid "This stage checks the user's current session against the Google reCaptcha service."
-msgstr "Ten etap sprawdza bieżącą sesję użytkownika z usługą Google reCaptcha."
+msgid "This stage checks the user's current session against the Google reCaptcha (or compatible) service."
+msgstr ""
+
+#: src/admin/stages/captcha/CaptchaStageForm.ts
+#~ msgid "This stage checks the user's current session against the Google reCaptcha service."
+#~ msgstr "Ten etap sprawdza bieżącą sesję użytkownika z usługą Google reCaptcha."

 #: src/admin/policies/reputation/ReputationPolicyForm.ts
 msgid "Threshold"
@ -6309,6 +6321,10 @@ msgstr "URL, do którego wysyłane jest początkowe żądanie logowania."
 msgid "URL the user is redirect to to consent the authorization."
 msgstr "URL, do którego użytkownik jest przekierowywany, aby wyrazić zgodę na autoryzację."

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "URL to fetch JavaScript from, defaults to recaptcha. Can be replaced with any compatible alternative."
+msgstr ""
+
 #: src/admin/sources/oauth/OAuthSourceForm.ts
 msgid "URL used by authentik to get user information."
 msgstr "URL używany przez authentik do uzyskania informacji o użytkowniku."
@ -6321,6 +6337,10 @@ msgstr "URL używany przez authentik do pobierania tokenów."
 msgid "URL used to request the initial token. This URL is only required for OAuth 1."
 msgstr "URL używany do żądania początkowego tokena. Ten adres URL jest wymagany tylko w przypadku protokołu OAuth 1."

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "URL used to validate captcha response, defaults to recaptcha. Can be replaced with any compatible alternative."
+msgstr ""
+
 #: src/admin/applications/wizard/link/TypeLinkApplicationWizardPage.ts
 msgid "URL which will be opened when a user clicks on the application."
 msgstr ""
--- a/web/src/locales/pseudo-LOCALE.po
+++ b/web/src/locales/pseudo-LOCALE.po
@ -159,6 +159,10 @@ msgstr ""
 msgid "API Token (can be used to access the API programmatically)"
 msgstr ""

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "API URL"
+msgstr ""
+
 #: src/elements/messages/Middleware.ts
 msgid "API request failed"
 msgstr ""
@ -325,9 +329,9 @@ msgstr ""
 msgid "Advanced protocol settings"
 msgstr ""

-#: src/admin/policies/password/PasswordPolicyForm.ts
-#~ msgid "Advanced settings"
-#~ msgstr ""
+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "Advanced settings"
+msgstr ""

 #: src/admin/events/EventInfo.ts
 msgid "Affected model:"
@ -3066,6 +3070,10 @@ msgstr ""
 msgid "Issuer mode"
 msgstr ""

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "JS URL"
+msgstr ""
+
 #: src/admin/sources/oauth/OAuthSourceForm.ts
 msgid "JSON Web Key URL. Keys from the URL will be used to validate JWTs from this source."
 msgstr ""
@ -6208,9 +6216,13 @@ msgid "This stage can be included in enrollment flows to accept invitations."
 msgstr ""

 #: src/admin/stages/captcha/CaptchaStageForm.ts
-msgid "This stage checks the user's current session against the Google reCaptcha service."
+msgid "This stage checks the user's current session against the Google reCaptcha (or compatible) service."
 msgstr ""

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+#~ msgid "This stage checks the user's current session against the Google reCaptcha service."
+#~ msgstr ""
+
 #: src/admin/policies/reputation/ReputationPolicyForm.ts
 msgid "Threshold"
 msgstr ""
@ -6441,6 +6453,10 @@ msgstr ""
 msgid "URL the user is redirect to to consent the authorization."
 msgstr ""

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "URL to fetch JavaScript from, defaults to recaptcha. Can be replaced with any compatible alternative."
+msgstr ""
+
 #: src/admin/sources/oauth/OAuthSourceForm.ts
 msgid "URL used by authentik to get user information."
 msgstr ""
@ -6453,6 +6469,10 @@ msgstr ""
 msgid "URL used to request the initial token. This URL is only required for OAuth 1."
 msgstr ""

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "URL used to validate captcha response, defaults to recaptcha. Can be replaced with any compatible alternative."
+msgstr ""
+
 #: src/admin/applications/wizard/link/TypeLinkApplicationWizardPage.ts
 msgid "URL which will be opened when a user clicks on the application."
 msgstr ""
--- a/web/src/locales/tr.po
+++ b/web/src/locales/tr.po
@ -165,6 +165,10 @@ msgstr "API İstekleri"
 msgid "API Token (can be used to access the API programmatically)"
 msgstr "API Belirteci (API'ye programlı olarak erişmek için kullanılabilir)"

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "API URL"
+msgstr ""
+
 #: src/elements/messages/Middleware.ts
 msgid "API request failed"
 msgstr "API isteği başarısız"
@ -325,9 +329,9 @@ msgstr "Yönetici arayüzü"
 msgid "Advanced protocol settings"
 msgstr "Gelişmiş protokol ayarları"

-#: src/admin/policies/password/PasswordPolicyForm.ts
-#~ msgid "Advanced settings"
-#~ msgstr "Gelişmiş ayarlar"
+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "Advanced settings"
+msgstr "Gelişmiş ayarlar"

 #: src/admin/events/EventInfo.ts
 msgid "Affected model:"
@ -3009,6 +3013,10 @@ msgstr "Yayımcı"
 msgid "Issuer mode"
 msgstr "Yayımcı kipi"

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "JS URL"
+msgstr ""
+
 #: src/admin/sources/oauth/OAuthSourceForm.ts
 msgid "JSON Web Key URL. Keys from the URL will be used to validate JWTs from this source."
 msgstr ""
@ -6072,8 +6080,12 @@ msgid "This stage can be included in enrollment flows to accept invitations."
 msgstr "Bu aşama, davetleri kabul etmek için kayıt akışlarına dahil edilebilir."

 #: src/admin/stages/captcha/CaptchaStageForm.ts
-msgid "This stage checks the user's current session against the Google reCaptcha service."
-msgstr "Bu aşama, kullanıcının geçerli oturumunu Google reCaptcha hizmetine karşı kontrol eder."
+msgid "This stage checks the user's current session against the Google reCaptcha (or compatible) service."
+msgstr ""
+
+#: src/admin/stages/captcha/CaptchaStageForm.ts
+#~ msgid "This stage checks the user's current session against the Google reCaptcha service."
+#~ msgstr "Bu aşama, kullanıcının geçerli oturumunu Google reCaptcha hizmetine karşı kontrol eder."

 #: src/admin/policies/reputation/ReputationPolicyForm.ts
 msgid "Threshold"
@ -6299,6 +6311,10 @@ msgstr "İlk oturum açma isteğinin gönderildiği URL."
 msgid "URL the user is redirect to to consent the authorization."
 msgstr "Kullanıcının yetkilendirmeyi onaylamak için yönlendirdiği URL."

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "URL to fetch JavaScript from, defaults to recaptcha. Can be replaced with any compatible alternative."
+msgstr ""
+
 #: src/admin/sources/oauth/OAuthSourceForm.ts
 msgid "URL used by authentik to get user information."
 msgstr "Kullanıcı bilgilerini almak için authentik tarafından kullanılan URL."
@ -6311,6 +6327,10 @@ msgstr "Auentik tarafından belirteçleri almak için kullanılan URL."
 msgid "URL used to request the initial token. This URL is only required for OAuth 1."
 msgstr "İlk belirteci istemek için kullanılan URL. Bu URL yalnızca OAuth 1 için gereklidir."

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "URL used to validate captcha response, defaults to recaptcha. Can be replaced with any compatible alternative."
+msgstr ""
+
 #: src/admin/applications/wizard/link/TypeLinkApplicationWizardPage.ts
 msgid "URL which will be opened when a user clicks on the application."
 msgstr ""
--- a/web/src/locales/zh-Hans.po
+++ b/web/src/locales/zh-Hans.po
@ -167,6 +167,10 @@ msgstr "API 请求"
 msgid "API Token (can be used to access the API programmatically)"
 msgstr "API 令牌（可用于以编程方式访问 API）"

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "API URL"
+msgstr ""
+
 #: src/elements/messages/Middleware.ts
 msgid "API request failed"
 msgstr "API 请求失败"
@ -331,9 +335,9 @@ msgstr "管理员界面"
 msgid "Advanced protocol settings"
 msgstr "高级协议设置"

-#: src/admin/policies/password/PasswordPolicyForm.ts
-#~ msgid "Advanced settings"
-#~ msgstr "高级设置"
+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "Advanced settings"
+msgstr "高级设置"

 #: src/admin/events/EventInfo.ts
 msgid "Affected model:"
@ -3017,6 +3021,10 @@ msgstr "颁发者"
 msgid "Issuer mode"
 msgstr "Issuer 模式"

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "JS URL"
+msgstr ""
+
 #: src/admin/sources/oauth/OAuthSourceForm.ts
 msgid "JSON Web Key URL. Keys from the URL will be used to validate JWTs from this source."
 msgstr "JSON Web Key URL。来自此 URL 的 Key 将被用于验证此身份来源的 JWT。"
@ -6080,8 +6088,12 @@ msgid "This stage can be included in enrollment flows to accept invitations."
 msgstr "此阶段可以包含在注册流程中以接受邀请。"

 #: src/admin/stages/captcha/CaptchaStageForm.ts
-msgid "This stage checks the user's current session against the Google reCaptcha service."
-msgstr "此阶段会根据 Google reCAPTCHA 服务检查用户的当前会话。"
+msgid "This stage checks the user's current session against the Google reCaptcha (or compatible) service."
+msgstr ""
+
+#: src/admin/stages/captcha/CaptchaStageForm.ts
+#~ msgid "This stage checks the user's current session against the Google reCaptcha service."
+#~ msgstr "此阶段会根据 Google reCAPTCHA 服务检查用户的当前会话。"

 #: src/admin/policies/reputation/ReputationPolicyForm.ts
 msgid "Threshold"
@ -6307,6 +6319,10 @@ msgstr "初始登录请求发送到的 URL。"
 msgid "URL the user is redirect to to consent the authorization."
 msgstr "用户被重定向到以同意授权的 URL。"

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "URL to fetch JavaScript from, defaults to recaptcha. Can be replaced with any compatible alternative."
+msgstr ""
+
 #: src/admin/sources/oauth/OAuthSourceForm.ts
 msgid "URL used by authentik to get user information."
 msgstr "authentik 用来获取用户信息的 URL。"
@ -6319,6 +6335,10 @@ msgstr "authentik 用来获取令牌的 URL。"
 msgid "URL used to request the initial token. This URL is only required for OAuth 1."
 msgstr "用于请求初始令牌的 URL。只有 OAuth 1 才需要此网址。"

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "URL used to validate captcha response, defaults to recaptcha. Can be replaced with any compatible alternative."
+msgstr ""
+
 #: src/admin/applications/wizard/link/TypeLinkApplicationWizardPage.ts
 msgid "URL which will be opened when a user clicks on the application."
 msgstr ""
--- a/web/src/locales/zh-Hant.po
+++ b/web/src/locales/zh-Hant.po
@ -167,6 +167,10 @@ msgstr "API 请求"
 msgid "API Token (can be used to access the API programmatically)"
 msgstr "API 令牌（可用于以编程方式访问 API）"

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "API URL"
+msgstr ""
+
 #: src/elements/messages/Middleware.ts
 msgid "API request failed"
 msgstr "API 请求失败"
@ -331,9 +335,9 @@ msgstr "管理员界面"
 msgid "Advanced protocol settings"
 msgstr "高级协议设置"

-#: src/admin/policies/password/PasswordPolicyForm.ts
-#~ msgid "Advanced settings"
-#~ msgstr "高级设置"
+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "Advanced settings"
+msgstr "高级设置"

 #: src/admin/events/EventInfo.ts
 msgid "Affected model:"
@ -3017,6 +3021,10 @@ msgstr "Issuer"
 msgid "Issuer mode"
 msgstr "Issuer mode"

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "JS URL"
+msgstr ""
+
 #: src/admin/sources/oauth/OAuthSourceForm.ts
 msgid "JSON Web Key URL. Keys from the URL will be used to validate JWTs from this source."
 msgstr ""
@ -6080,8 +6088,12 @@ msgid "This stage can be included in enrollment flows to accept invitations."
 msgstr "此阶段可以包含在注册流程中以接受邀请。"

 #: src/admin/stages/captcha/CaptchaStageForm.ts
-msgid "This stage checks the user's current session against the Google reCaptcha service."
-msgstr "此阶段会根据 Google reCAPTCHA 服务检查用户的当前会话。"
+msgid "This stage checks the user's current session against the Google reCaptcha (or compatible) service."
+msgstr ""
+
+#: src/admin/stages/captcha/CaptchaStageForm.ts
+#~ msgid "This stage checks the user's current session against the Google reCaptcha service."
+#~ msgstr "此阶段会根据 Google reCAPTCHA 服务检查用户的当前会话。"

 #: src/admin/policies/reputation/ReputationPolicyForm.ts
 msgid "Threshold"
@ -6307,6 +6319,10 @@ msgstr "初始登录请求发送到的URL。"
 msgid "URL the user is redirect to to consent the authorization."
 msgstr "用户被重定向到以同意授权的 URL。"

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "URL to fetch JavaScript from, defaults to recaptcha. Can be replaced with any compatible alternative."
+msgstr ""
+
 #: src/admin/sources/oauth/OAuthSourceForm.ts
 msgid "URL used by authentik to get user information."
 msgstr "authentik 用来获取用户信息的 URL。"
@ -6319,6 +6335,10 @@ msgstr "authentik 用来检索令牌的 URL。"
 msgid "URL used to request the initial token. This URL is only required for OAuth 1."
 msgstr "用于请求初始令牌的 URL。只有 OAuth 1 才需要此网址。"

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "URL used to validate captcha response, defaults to recaptcha. Can be replaced with any compatible alternative."
+msgstr ""
+
 #: src/admin/applications/wizard/link/TypeLinkApplicationWizardPage.ts
 msgid "URL which will be opened when a user clicks on the application."
 msgstr ""
--- a/web/src/locales/zh_TW.po
+++ b/web/src/locales/zh_TW.po
@ -167,6 +167,10 @@ msgstr "API 请求"
 msgid "API Token (can be used to access the API programmatically)"
 msgstr "API 令牌（可用于以编程方式访问 API）"

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "API URL"
+msgstr ""
+
 #: src/elements/messages/Middleware.ts
 msgid "API request failed"
 msgstr "API 请求失败"
@ -331,9 +335,9 @@ msgstr "管理员界面"
 msgid "Advanced protocol settings"
 msgstr "高级协议设置"

-#: src/admin/policies/password/PasswordPolicyForm.ts
-#~ msgid "Advanced settings"
-#~ msgstr "高级设置"
+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "Advanced settings"
+msgstr "高级设置"

 #: src/admin/events/EventInfo.ts
 msgid "Affected model:"
@ -3017,6 +3021,10 @@ msgstr "Issuer"
 msgid "Issuer mode"
 msgstr "Issuer mode"

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "JS URL"
+msgstr ""
+
 #: src/admin/sources/oauth/OAuthSourceForm.ts
 msgid "JSON Web Key URL. Keys from the URL will be used to validate JWTs from this source."
 msgstr ""
@ -6080,8 +6088,12 @@ msgid "This stage can be included in enrollment flows to accept invitations."
 msgstr "此阶段可以包含在注册流程中以接受邀请。"

 #: src/admin/stages/captcha/CaptchaStageForm.ts
-msgid "This stage checks the user's current session against the Google reCaptcha service."
-msgstr "此阶段会根据 Google reCAPTCHA 服务检查用户的当前会话。"
+msgid "This stage checks the user's current session against the Google reCaptcha (or compatible) service."
+msgstr ""
+
+#: src/admin/stages/captcha/CaptchaStageForm.ts
+#~ msgid "This stage checks the user's current session against the Google reCaptcha service."
+#~ msgstr "此阶段会根据 Google reCAPTCHA 服务检查用户的当前会话。"

 #: src/admin/policies/reputation/ReputationPolicyForm.ts
 msgid "Threshold"
@ -6307,6 +6319,10 @@ msgstr "初始登录请求发送到的URL。"
 msgid "URL the user is redirect to to consent the authorization."
 msgstr "用户被重定向到以同意授权的 URL。"

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "URL to fetch JavaScript from, defaults to recaptcha. Can be replaced with any compatible alternative."
+msgstr ""
+
 #: src/admin/sources/oauth/OAuthSourceForm.ts
 msgid "URL used by authentik to get user information."
 msgstr "authentik 用来获取用户信息的 URL。"
@ -6319,6 +6335,10 @@ msgstr "authentik 用来检索令牌的 URL。"
 msgid "URL used to request the initial token. This URL is only required for OAuth 1."
 msgstr "用于请求初始令牌的 URL。只有 OAuth 1 才需要此网址。"

+#: src/admin/stages/captcha/CaptchaStageForm.ts
+msgid "URL used to validate captcha response, defaults to recaptcha. Can be replaced with any compatible alternative."
+msgstr ""
+
 #: src/admin/applications/wizard/link/TypeLinkApplicationWizardPage.ts
 msgid "URL which will be opened when a user clicks on the application."
 msgstr ""