PHPackages kraftware/sw6-store-api-captcha - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. kraftware/sw6-store-api-captcha ActiveShopware-platform-plugin kraftware/sw6-store-api-captcha =============================== Enforce Shopware core captchas on Store API routes 7.0.0(1mo ago)02proprietaryPHPPHP ^8.2 Since Jul 15Pushed 1mo agoCompare [ Source](https://github.com/runelaenen/sw6-store-api-captcha)[ Packagist](https://packagist.org/packages/kraftware/sw6-store-api-captcha)[ RSS](/packages/kraftware-sw6-store-api-captcha/feed)WikiDiscussions main Synced 1w ago READMEChangelogDependencies (2)Versions (2)Used By (0) Kraftware Store API Captcha =========================== [](#kraftware-store-api-captcha) Enforce Shopware's **core** captchas on **Store API** routes. Shopware only enforces captchas on Storefront routes out of the box; this plugin extends the same captcha framework to the Store API, which is useful for headless / composable frontends and API integrations. No new captcha type is added. The plugin reuses the captchas registered under the `shopware.storefront.captcha` tag (Honeypot, Google reCAPTCHA v2/v3, and any third-party captcha such as Cloudflare Turnstile) and the captcha selection configured under **Settings → Basic information**. How a route gets protected -------------------------- [](#how-a-route-gets-protected) A Store API route is protected when **either**: 1. **It declares the `_captcha` route attribute** — parity with how Storefront routes opt in. Plugin authors add `defaults={"_captcha"=true}` (or the attribute equivalent) to their own Store API route. Example: ``` #[Route(path: '/store-api/my-route', name: 'store-api.my-route', defaults: ['_captcha' => true], methods: ['POST'])] ``` 2. **Its route name is listed in the plugin configuration** — open the plugin config and add one Store API **route name** per line, e.g.: ``` store-api.account.register store-api.contact.form ``` Use mechanism 2 to protect existing core or third-party routes without changing their code. Matching is by **exact route name** (the Symfony `_route`). Behaviour --------- [](#behaviour) - Runs only for requests in the `store-api` route scope; Storefront and Admin API behaviour is untouched. - On captcha failure the request is rejected with the core `CaptchaException`: **HTTP 403**, error code `FRAMEWORK__INVALID_CAPTCHA_VALUE`, as a Store API JSON error. - On success the request proceeds normally. - Honors per-sales-channel configuration for both the route list and the captcha selection. - **Only POST requests are validated.** The core captchas apply to form/POST submissions and return `supports() === false` for other methods. GET requests are never captcha-checked, so protect state-changing POST routes. Adding a GET-only (or GET-served) route to the list does not captcha-protect its GET traffic. Client responsibility --------------------- [](#client-responsibility) This plugin only **validates**. The API client must obtain the captcha token and send the captcha parameter in the request body, e.g. `_grecaptcha_v3` for Google reCAPTCHA v3. Captcha parameters sent in a JSON body are read correctly (Shopware decodes the JSON body into the request parameters before validation). Notes and limitations --------------------- [](#notes-and-limitations) - **Storefront bundle required.** The captcha implementations live in `shopware/storefront`, which is a hard dependency. A pure headless install without the Storefront bundle is not supported. - **Token-based captchas recommended.** Google reCAPTCHA v2/v3 (and other token-verified captchas) are stateless and work well over the Store API. - **BasicCaptcha is skipped, not enforced.** The image-based BasicCaptcha reports `shouldBreak() === false` because it expects an interactive image/session challenge that cannot be presented to a stateless API client. Rather than hard-block every request, the plugin skips any active captcha whose `shouldBreak()` is `false`. Do not rely on BasicCaptcha for Store API protection. - **Honeypot is weak on a headless client.** Honeypot treats an empty field as valid, which works against bots that blindly fill hidden form fields. A first-party API client simply never sends the field, so honeypot passes every request and provides little real protection over the Store API. Prefer a token-verified captcha. ### Health Score 38 — LowBetter than 83% of packages Maintenance90 Actively maintained with recent releases Popularity3 Limited adoption so far Community6 Small or concentrated contributor base Maturity46 Maturing project, gaining track record Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Unknown Total 1 Last Release 47d ago ### Community Maintainers ![](https://avatars.githubusercontent.com/u/3930922?v=4)[Rune Laenen](/maintainers/runelaenen)[@runelaenen](https://github.com/runelaenen) --- Top Contributors [![runelaenen](https://avatars.githubusercontent.com/u/3930922?v=4)](https://github.com/runelaenen "runelaenen (1 commits)") ### Embed Badge ![Health badge](/badges/kraftware-sw6-store-api-captcha/health.svg) ``` [![Health](https://phpackages.com/badges/kraftware-sw6-store-api-captcha/health.svg)](https://phpackages.com/packages/kraftware-sw6-store-api-captcha) ``` ### Alternatives [shopware/production 176224.4k](/packages/shopware-production)[adyen/adyen-shopware6 Official Shopware 6 Plugin to connect to Payment Service Provider Adyen 23121.1k](/packages/adyen-adyen-shopware6)[unzerdev/shopware6 Unzer payment integration for Shopware 6 1238.4k](/packages/unzerdev-shopware6)[kiener/mollie-payments-plugin Mollie Payments 6770.3k](/packages/kiener-mollie-payments-plugin)[shopware/storefront Storefront for Shopware 684.9M305](/packages/shopware-storefront)[payone-gmbh/shopware-6 PAYONE Payment Plugin 2187.3k](/packages/payone-gmbh-shopware-6) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)