Implement reCAPTCHA for abuse prevention

[chadwhitacre]

Redux of #234. Initial rebase here drops some README changes in favor of HEAD, but otherwise should match 8330ac6.

[chadwhitacre]

Rebased again to drop the commits that add the dist directory to the repo: f5604a5 04d33c1. That seems a distraction. Was 947d908.

[chadwhitacre]

Alright, squashed all the commits and removed the remaining bits that were changing orthogonal plumbing vs. actually adding the feature in scope. Was c1294cc.

[chadwhitacre]

Testing with Heroku templating ...

[chadwhitacre]

[chadwhitacre]

[chadwhitacre]

---

[chadwhitacre]

Ready for review, @rauchg!

[chadwhitacre]

Test here if you like (will leave up temporarily):

https://immense-forest-91787.herokuapp.com/

[rauchg]

@whit537 thanks a lot! One last thing before we merge this: do you think it's a good idea to enforce Google reCAPTCHA on every single installation, rather than making it optional?

[chadwhitacre]

I think it should be hard to deploy SlackIn insecurely ("secure by default"). If reCAPTCHA is optional then it should be an explicit opt-out with a clear warning about SlackOut.

[chadwhitacre]

... and I guess I would see that as out-of-scope for this PR. Right now SlackIn exposes its users to a non-trivial vulnerability. Reducing that exposure is important. Adding a footgun back into SlackIn can be done later.

[chadwhitacre]

Ready to merge, @rauchg?

[chadwhitacre]

Announced: https://twitter.com/Gratipay/status/870366843000811521.

[toolmantim]

Was this made to also work with the badge version? Because I'm trying to upgrade (for Node security updates) but can't seem to get this to work, and I can't see how it did?

When you try to send an invite you get:

TypeError: undefined is not an object (evaluating 'gcaptcha_response.value')

It works fine if you go to it directly:

[chadwhitacre]

I don't recall seeing anything about the badge version when I was cleaning up the PR. I suggest making a new ticket/PR.

[toolmantim]

@whit537 I've done some digging, and it looks like you might have forgotten to update the badge to support recaptcha. I've opened up a WIP pull request here: #332 Would love your help/thoughts.

[chadwhitacre]

you might have forgotten to update the badge to support recaptcha

Sorry about that. :-/

[toolmantim]

It happens! 😊

[Daniel15]

Can you please publish this update to npm? slackin on npm is still 0.13.0

[jpoon]

FYI, this PR broke the Azure deployment: #355. Need to update the environment variables here: https://github.com/rauchg/slackin/blob/master/azuredeploy.json#L99

[KrzysztofMadejski]

These setting for Azure deployment are fixed in #333