Proof of Work Mechanism
This documentation covers SCaptcha 2.3.0. Configuration-dependent features are identified separately.
Core verification
Each challenge uses its own cryptographically random 32-byte salt. Your WoltLab installation validates the salt, hash, algorithm, answer, and HMAC against the issuing session. The challenge expires after 60 seconds and does not require an external CAPTCHA provider.
Challenge Generation
The server generates an independent, cryptographically random 32-byte salt for every newly issued challenge. No fixed application salt is reused for fresh issuance.
Server Signature
An HMAC signature is created with the session secret so the client cannot tamper with the challenge.
Client-Side Task
The client iteratively computes solutions by combining numbers with the provided salt until it matches the challenge, then submits a base64 JSON payload with algorithm, challenge, number, salt, signature, and took.
Solution Verification
Using the received salt and number, the server re-computes the challenge, validates the HMAC signature, and enforces a 60-second expiry window.
Adjusting Complexity
Complexity is adjusted by modifying the minimum and maximum values of the randomly generated secret number. Lower values solve faster, higher values add cost for automation.