Spam protection and CAPTCHA

This guide provides an overview of how to add spam protection and CAPTCHA support to new areas of the GitLab application.

Add spam protection and CAPTCHA support to a new area

To add this support, you must implement the following areas as applicable:

Model and Services: The basic prerequisite changes to the backend code which are required to add spam or CAPTCHA API and UI support for a feature which does not yet have support.
REST API: The changes needed to add spam or CAPTCHA support to Grape REST API endpoints. Refer to the related REST API documentation.
GraphQL API: The changes needed to add spam or CAPTCHA support to GraphQL mutations. Refer to the related GraphQL API documentation.
Web UI: The various possible scenarios encountered when adding spam/CAPTCHA support to the web UI, depending on whether the UI is JavaScript API-based (Vue or plain JavaScript) or HTML-form (HAML) based.

You should also perform manual exploratory testing of the new feature. Refer to Exploratory testing for more information.

Multiple levels of spam flagging determine how spam is handled. These levels are referenced in Spam::SpamConstants, and used various places in the application, such as Spam::SpamActionService#perform_spam_service_check.

The possible values include:

Edit this page to fix an error or add an improvement in a merge request.
Create an issue to suggest an improvement to this page.

Create an issue if there's something you don't like about this feature.
Propose functionality by submitting a feature request.
Join First Look to help shape new features.

View pricing to see all GitLab tiers and features, or to upgrade.
Try GitLab for free with access to all features for 30 days.

If you didn't find what you were looking for, search the docs.

If you want help with something specific and could use community support, post on the GitLab forum.

For problems setting up or using this feature (depending on your GitLab subscription).