Captcha can be enabled for this web client / home server. This file explains how to do that. The captcha mechanism used is Google's ReCaptcha. This requires API keys from Google. Getting keys ------------ Requires a public/private key pair from: https://developers.google.com/recaptcha/ Setting Private ReCaptcha Key ----------------------------- The private key is a config option on the home server config. If it is not visible, you can generate it via --generate-config. Set the following value: recaptcha_private_key: YOUR_PRIVATE_KEY In addition, you MUST enable captchas via: enable_registration_captcha: true Setting Public ReCaptcha Key ---------------------------- The web client will look for the global variable webClientConfig for config options. You should put your ReCaptcha public key there like so: webClientConfig = { useCaptcha: true, recaptcha_public_key: "YOUR_PUBLIC_KEY" }; This should be put in webclient/config.js which is already .gitignored, rather than in the web client source files. You MUST set useCaptcha to true else a ReCaptcha widget will not be generated. Configuring IP used for auth ---------------------------- The ReCaptcha API requires that the IP address of the user who solved the captcha is sent. If the client is connecting through a proxy or load balancer, it may be required to use the X-Forwarded-For (XFF) header instead of the origin IP address. This can be configured as an option on the home server like so: captcha_ip_origin_is_x_forwarded: true