CAPTCHA

As explained in Secure APIs

A CAPTCHA is an automated challenge-response test intended to distinguish human users from automated programs.

A CAPTCHA is an automated challenge-response test intended to distinguish human users from automated programs. For web applications, serving CAPTCHA challenges can reduce automated attacks against sensitive API-driven business flows, although no method completely prevents headless access. section 4.9

Use CAPTCHA as one layer in a broader defense:

• Challenge users when automated activity threatens a sensitive flow. section 4.9
• Combine it with user-agent checks, interaction-pattern detection, throttling, and blocking for suspected abuse. section 4.9

Figure 4.18 If our API is designed for consumption by a web application, a good strategy to mitigate automated attacks is serving CAPTCHA challenges.

The figure shows CAPTCHA challenges as a mitigation for automated attacks against an API consumed by a web application. section 4.9

How Secure APIs covers it

How deep it goes

Explains CAPTCHA’s defensive role and limits but does not detail challenge implementation.

Examples

Illustrates CAPTCHA protecting an API designed for consumption by a web application.

What you can do after

Apply CAPTCHA challenges as one layer of protection against suspected automated activity.

How it connects

Connects CAPTCHA with headless browsers, user-agent checks, threat detection, throttling, and blocking.

liveBookmanning.com

Read Secure APIs on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Grokking Web Application SecurityA CAPTCHA is an automated challenge-response test designed to distinguish human users from computer programs.

Compare how 2 books explain CAPTCHA →

Related concepts

• brute-force attackaddresses · A brute-force attack systematically tries numerous possible credentials, keys, inputs, or combinations until one succeeds or the search space is exhausted.
• WPFormsused by · WPForms is a WordPress plugin for creating contact forms with configurable features and fields.
• unrestricted access to sensitive business flowsaddresses · Unrestricted access to sensitive business flows is a vulnerability in which users or automated actors can abuse API-controlled business processes without adequate safeguards.
• GPT modelused by · A GPT model is a generative pretrained Transformer language model that produces text autoregressively by predicting successive tokens from preceding context.
• computer visionaddressed by · Computer vision is the field of computing concerned with using computational methods to extract and interpret information from images, video, and other visual data.

This explainer was generated by Manning's knowledge graph from the text of Secure APIs. The section links point to the parts of the book it draws on.