小林安全 人机验证

// Node.js (Express / Koa / Fastify) 校验示例

async function verifyXiaolinCaptcha(payload) {
  const secretKey = '您的_SecretKey';
  const res = await fetch('http://localhost:3000/api/v1/siteverify', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ secretKey, payload })
  });
  const data = await res.json();
  return data.success === true;
}

// 在路由中使用
app.post('/api/login', async (req, res) => {
  const { username, password, altcha } = req.body;
  
  const isHuman = await verifyXiaolinCaptcha(altcha);
  if (!isHuman) {
    return res.status(403).json({ error: '人机验证未通过或已过期' });
  }

  // 执行业务登录逻辑...
  res.json({ message: '登录成功' });
});

# Python (FastAPI / Flask / Django) 校验示例
import requests

def verify_xiaolin_captcha(payload: str) -> bool:
    secret_key = "您的_SecretKey"
    try:
        resp = requests.post(
            "http://localhost:3000/api/v1/siteverify",
            json={"secretKey": secret_key, "payload": payload},
            timeout=5
        )
        return resp.json().get("success") is True
    except Exception:
        return False

# 示例：Flask 接口
@app.route('/login', methods=['POST'])
def login():
    altcha_token = request.form.get('altcha')
    if not verify_xiaolin_captcha(altcha_token):
        return {"code": 403, "msg": "人机验证未通过"}, 403
    # 验证通过，继续处理业务...
    return {"code": 200, "msg": "登录成功"}

// Go (Gin 框架) 校验示例
package main

import (
    "bytes"
    "encoding/json"
    "net/http"
    "time"
)

type VerifyRequest struct {
    SecretKey string `json:"secretKey"`
    Payload   string `json:"payload"`
}

type VerifyResponse struct {
    Success bool   `json:"success"`
    Message string `json:"message"`
}

func verifyXiaolinCaptcha(payload string) bool {
    reqBody, _ := json.Marshal(VerifyRequest{
        SecretKey: "您的_SecretKey",
        Payload:   payload,
    })

    client := &http.Client{Timeout: 5 * time.Second}
    resp, err := client.Post("http://localhost:3000/api/v1/siteverify", "application/json", bytes.NewBuffer(reqBody))
    if err != nil || resp.StatusCode != 200 {
        return false
    }
    defer resp.Body.Close()

    var res VerifyResponse
    json.NewDecoder(resp.Body).Decode(&res)
    return res.Success
}

// Java (Spring Boot) 校验示例
import org.springframework.web.client.RestTemplate;
import java.util.Map;
import java.util.HashMap;

public class CaptchaService {
    private final RestTemplate restTemplate = new RestTemplate();
    private final String SECRET_KEY = "您的_SecretKey";
    private final String VERIFY_URL = "http://localhost:3000/api/v1/siteverify";

    public boolean verify(String payload) {
        try {
            Map body = new HashMap<>();
            body.put("secretKey", SECRET_KEY);
            body.put("payload", payload);

            Map response = restTemplate.postForObject(VERIFY_URL, body, Map.class);
            return response != null && Boolean.TRUE.equals(response.get("success"));
        } catch (Exception e) {
            return false;
        }
    }
}

# 命令行 cURL 测试调用
curl -X POST "http://localhost:3000/api/v1/siteverify" \
  -H "Content-Type: application/json" \
  -d '{
    "secretKey": "xl_sec_xxxxxxxxxxxxxx",
    "payload": "eyJhbGdvcml0aG0iOiJTSEEtMjU2Ii...=="
  }'