hCaptcha COEP compatibility

[matthieusieben]

When hCaptcha is embedded from a page that has COEP headers, it should also return COEP headers.

It seems that hCaptcha somewhat recently stopped serving COEP headers. I previously reported this in #259 and it seems the issue appeared again (see screenshot).

If the change was on purpose, it'd be great if it was possible to set them through an option as COEP headers help us keep our users safe.

[zoryana94]

Hi @matthieusieben,

Thank you a lot for notifying!
Bringing it to the team for further investigation
We will keep you posted

Best Regards,
hCaptcha Team

[brdlyptrs]

Hi @matthieusieben, this change will need to be carefully considered and rolled out if we are to implement it as we need to account for many different scenarios, devices, etc..

In the mean time can you reach out to support@hcaptcha.com, as they can help you resolve this issue for your particular setup in the interim.

[e271828-]

Closing as unrelated to react

[matthieusieben]

Hey @brdlyptrs thanks for you answer. Please note that this is actually a regression from hCaptcha. The COEP headers used to be returned for a while and we are getting reports that hCaptcha is now failing because they no longer are.

Note that this issue affects not only us. We distribute a docker image that can be configured to use hCaptcha if an hCaptcha config is provided (site key, etc.). By removing COEP headers, you broke all these instances. Currently that represents over 1k multi-tenant Atproto PDS.

[knotbin]

This is definitely a regression from when it was fixed in #259 about a year ago. It's been working ever since and only stopped working extremely recently.

It would be great if this issue could be re-opened and looked at. We operate one of the independent PDS instances @matthieusieben was referring to and this stops us from allowing any new users to sign up.

[ThisIsMissEm]

This issue is currently blocking a platform launch that I'm involved in. Our users cannot signup to our service due to this issue. It was working when we tested a few weeks ago, and now no one can signup to our service.

[e271828-]

Just to clarify, hCaptcha headers haven't changed, but browsers can of course change their COEP behavior.

Also, note that Chrome recently shipped DIP as a lighter alternative. If you use Document-Isolation-Policy: isolate-and-credentialless instead of COEP It is not cascading, so you can isolate your main document without requiring third-party SDKs to have any special headers.

However, we are reviewing the impact of adding COEP, either for everyone or opt-in, and will likely have an update in the next day or so.