Overview
The challenge package defines the challenge system for bot detection. Challenges are cryptographic or computational puzzles that legitimate browsers can solve but bots typically cannot.Types
Challenge
Metadata about a single challenge issuance.Timestamp when the challenge was created
Additional context stored with the challengeCommon keys:
User-Agent: Client user agent stringX-Real-Ip: Client IP address
Unique UUID (v7) identifier for this challenge
Challenge algorithm nameBuilt-in methods:
fast: Proof-of-work (SHA-256 based)preact: Interactive JavaScript challengemetarefresh: Meta refresh redirect challenge
Hexadecimal-encoded random bytes (64 bytes) that the client must process
Hash of the bot policy rule that triggered this challenge. Used to detect policy changes.
Computational difficulty for proof-of-work challenges (0-64). Higher values require more CPU time.Recommended values:
- 15-18: Low security, fast solving (~100ms)
- 19-22: Medium security (~500ms)
- 23-25: High security (~2-5s)
- 26+: Very high security (10s+)
Whether this challenge has already been successfully solved. Prevents replay attacks.
lib/challenge/challenge.go:5-15
IssueInput
Input parameters for the challenge Issue method.Legal/contact information to display on challenge page
The bot detection rule that triggered this challenge
The challenge instance being issued
OpenGraph metadata tags for the page being protected
Storage backend for persisting challenge state
lib/challenge/interface.go:45-51
ValidateInput
Input parameters for the challenge Validate method.The policy rule associated with this challenge
The challenge being validated
Storage backend for challenge data
lib/challenge/interface.go:53-57
Interfaces
Impl
Interface for challenge algorithm implementations.Setup
Registers any HTTP routes needed by the challenge implementation (e.g., for serving JavaScript bundles or API endpoints).HTTP router to register routes with
Issue
Generates the challenge page component to display to the user.HTTP response writer (for setting headers)
HTTP request being challenged
Structured logger with request context
Challenge issuance parameters
Templ component to render as the challenge page
Error if challenge generation fails
lib/challenge/interface.go:64
Validate
Validates that the user correctly solved the challenge.HTTP request containing the challenge solution
Structured logger with request context
Challenge validation parameters
Returns nil if validation succeeds, or an error describing why validation failed
*challenge.Error for user-facing validation failures:
lib/challenge/interface.go:67
Functions
Register
Registers a challenge implementation with the global registry.Unique name for the challenge algorithm (e.g., “fast”, “preact”)
Challenge implementation
lib/challenge/interface.go:20-24
Get
Retrieves a registered challenge implementation by name.Challenge algorithm name
The challenge implementation, if found
True if the challenge exists in the registry
lib/challenge/interface.go:27-32
Methods
Returns a sorted list of all registered challenge algorithm names.Sorted slice of challenge algorithm names
lib/challenge/interface.go:34-43
Error Types
Error
Challenge validation error with public and private messages.Internal error details (not shown to users)
Action that failed (e.g., “validate”, “decode”)
User-friendly error message displayed on error page
HTTP status code for the error response (default: 403)
lib/challenge/error.go:24-29
NewError
Creates a new challenge error.Action being performed when error occurred
User-facing error description
Internal error to log and wrap
Challenge error with status code 403
lib/challenge/error.go:15-21
Sentinel Errors
User submitted an incorrect solution
Required field missing from request
Field has incorrect format or encoding
lib/challenge/error.go:9-13
Built-in Challenges
Anubis includes three challenge implementations:fast (Proof of Work)
SHA-256 based proof-of-work challenge. Client must find a nonce that produces a hash with N leading zero bits. Difficulty mapping: Each difficulty level adds one zero bit requirement.preact (Interactive)
React-based interactive challenge requiring user interaction. Tests JavaScript execution and user behavior.metarefresh
Meta refresh redirect challenge. Tests basic HTML parsing and redirect following.Related Types
- Anubis Server - Server integration
- Policy - Challenge triggering rules
- Store - Challenge persistence