reCAPTCHA

GitLab leverages Google’s reCAPTCHA to protect against spam and abuse. GitLab displays the CAPTCHA form on the sign-up page to confirm that a real user, not a bot, is attempting to create an account.

Configuration

To use reCAPTCHA, first you must create a site and private key.

  1. Go to the Google reCAPTCHA page.
  2. Fill out the form necessary to obtain reCAPTCHA v2 keys.
  3. Log in to your GitLab server, with administrator credentials.
  4. Go to Reporting Applications Settings in the Admin Area (admin/application_settings/reporting).
  5. Expand the Spam and Anti-bot Protection section.
  6. Fill all reCAPTCHA fields with keys from previous steps.
  7. Select the Enable reCAPTCHA checkbox.
  8. To enable reCAPTCHA for logins via password, select the Enable reCAPTCHA for login checkbox.
  9. Save the configuration.
  10. Change the first line of the #execute method in app/services/spam/spam_verdict_service.rb to return CONDITIONAL_ALLOW so that the spam check short-circuits and triggers the response to return recaptcha_html.
note
Make sure you are viewing an issuable in a project that is public. If you’re working with an issue, the issue is public.

Enable reCAPTCHA for user logins using the HTTP header

You can enable reCAPTCHA for user logins via password in the user interface or by setting the X-GitLab-Show-Login-Captcha HTTP header. For example, in NGINX, this can be done via the proxy_set_header configuration variable: 

proxy_set_header X-GitLab-Show-Login-Captcha 1;

In Omnibus GitLab, this can be configured via /etc/gitlab/gitlab.rb: 

nginx['proxy_set_headers'] = { 'X-GitLab-Show-Login-Captcha' => '1' }