Skip to content
Corex

CaptchaHostnamePolicy

Corex\Captcha\CaptchaHostnamePolicy · class · Add-ons layer

Decides whether the hostname a provider reports is one this site permits. Exact, normalised comparison against an explicit allowlist — never a substring match. The substring shortcut (str_contains($allowed, $reported)) is the classic reCAPTCHA verification hole: it accepts corex.local.evil.com because it “contains” corex.local.

Public API

Section titled “Public API”

__construct(array $allowed)

Section titled “__construct(array $allowed)”

allows(string $hostname): bool

Section titled “allows(string $hostname): bool”

allowed(): array

Section titled “allowed(): array”