refactor: move go-chi/captcha into Gitea (#39529)

The `gitea.com/go-chi/captcha` package only exists for Gitea,
so it moves into `modules/imagecaptcha`.

- Reloading an expired challenge shows a new image instead of a broken one
- Every answer is consumed on its first check
- OpenID registration stops after a failed captcha

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

go.mod

@@ -7,7 +7,6 @@ toolchain go1.27.1
 require (
 	connectrpc.com/connect v1.21.0
 	gitea.com/go-chi/cache v0.2.1
-	gitea.com/go-chi/captcha v0.0.0-20240315150714-fb487f629098
 	gitea.com/go-chi/session v0.0.0-20260708011333-ebced8a7a2d6
 	gitea.com/lunny/dingtalk_webhook v0.0.0-20171025031554-e3534c89ef96
 	gitea.com/lunny/levelqueue v0.4.2-0.20230414023320-3c0159fe0fe4

go.sum

@@ -10,8 +10,6 @@ filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
 filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
 gitea.com/go-chi/cache v0.2.1 h1:bfAPkvXlbcZxPCpcmDVCWoHgiBSBmZN/QosnZvEC0+g=
 gitea.com/go-chi/cache v0.2.1/go.mod h1:Qic0HZ8hOHW62ETGbonpwz8WYypj9NieU9659wFUJ8Q=
-gitea.com/go-chi/captcha v0.0.0-20240315150714-fb487f629098 h1:p2ki+WK0cIeNQuqjR98IP2KZQKRzJJiV7aTeMAFwaWo=
-gitea.com/go-chi/captcha v0.0.0-20240315150714-fb487f629098/go.mod h1:LjzIOHlRemuUyO7WR12fmm18VZIlCAaOt9L3yKw40pk=
 gitea.com/go-chi/session v0.0.0-20260708011333-ebced8a7a2d6 h1:YWzVGeC/8SZThrJS48ZmQYLkzssdeABxHPhbdnxPDIU=
 gitea.com/go-chi/session v0.0.0-20260708011333-ebced8a7a2d6/go.mod h1:KDvcfMUoXfATPHs2mbMoXFTXT45/FAFAS39waz9tPk0=
 gitea.com/lunny/dingtalk_webhook v0.0.0-20171025031554-e3534c89ef96 h1:+wWBi6Qfruqu7xJgjOIrKVQGiLUZdpKYCZewJ4clqhw=

modules/imagecaptcha/image.go

@@ -0,0 +1,172 @@
+// Copyright 2011-2014 Dmitry Chestnykh. All rights reserved.
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package imagecaptcha
+
+import (
+	"image"
+	"image/color"
+	"math"
+	"math/rand/v2"
+)
+
+const (
+	imageWidth  = 240
+	imageHeight = 80
+	fontWidth   = 11
+	fontHeight  = 18
+	maxSkew     = 0.7
+	circleCount = 20
+)
+
+type captchaImage struct {
+	*image.Paletted
+	rng       *rand.Rand
+	numWidth  int
+	numHeight int
+	dotSize   int
+}
+
+func drawImage(rng *rand.Rand, code string) *image.Paletted {
+	img := &captchaImage{rng: rng}
+	img.initPalette()
+	img.calculateSizes(len(code))
+	border := imageHeight / 5
+	maxX := imageWidth - (img.numWidth+img.dotSize)*len(code) - img.dotSize
+	maxY := imageHeight - img.numHeight - img.dotSize*2
+	x := img.randInt(border, maxX-border)
+	y := img.randInt(border, maxY-border)
+	for i := range code {
+		img.drawDigit(code[i], x, y)
+		x += img.numWidth + img.dotSize
+	}
+	img.strikeThrough()
+	img.distort(img.randFloat(5, 10), img.randFloat(100, 200))
+	img.fillWithCircles(circleCount, img.dotSize)
+	return img.Paletted
+}
+
+func (img *captchaImage) initPalette() {
+	primary := primaryColors[img.rng.IntN(len(primaryColors))]
+	palette := color.Palette{color.Transparent, primary}
+	for range circleCount - 1 {
+		palette = append(palette, img.randomBrightness(primary))
+	}
+	img.Paletted = image.NewPaletted(image.Rect(0, 0, imageWidth, imageHeight), palette)
+}
+
+func (img *captchaImage) randomBrightness(c color.RGBA) color.RGBA {
+	minChannel, maxChannel := min(c.R, c.G, c.B), max(c.R, c.G, c.B)
+	shift := img.rng.IntN(math.MaxUint8-int(maxChannel)+1) - int(minChannel)
+	return color.RGBA{R: uint8(int(c.R) + shift), G: uint8(int(c.G) + shift), B: uint8(int(c.B) + shift), A: c.A}
+}
+
+func (img *captchaImage) randInt(from, to int) int {
+	return img.rng.IntN(to+1-from) + from
+}
+
+func (img *captchaImage) randFloat(from, to float64) float64 {
+	return (to-from)*img.rng.Float64() + from
+}
+
+func (img *captchaImage) calculateSizes(digitCount int) {
+	border := imageHeight / 4
+	width := float64(imageWidth - border*2)
+	height := float64(imageHeight - border*2)
+	glyphWidth := float64(fontWidth + 1)
+	glyphHeight := float64(fontHeight)
+	digitWidth := width / float64(digitCount)
+	digitHeight := digitWidth * glyphHeight / glyphWidth
+	if digitHeight > height {
+		digitHeight = height
+		digitWidth = glyphWidth / glyphHeight * digitHeight
+	}
+	img.dotSize = max(int(digitHeight/glyphHeight), 1)
+	img.numWidth = int(digitWidth) - img.dotSize
+	img.numHeight = int(digitHeight)
+}
+
+func (img *captchaImage) drawHorizLine(fromX, toX, y int, colorIndex uint8) {
+	for x := fromX; x <= toX; x++ {
+		img.SetColorIndex(x, y, colorIndex)
+	}
+}
+
+func (img *captchaImage) drawCircle(x, y, radius int, colorIndex uint8) {
+	decision := 1 - radius
+	offsetY := radius
+	for offsetX := 0; offsetX <= offsetY; offsetX++ {
+		img.drawHorizLine(x-offsetX, x+offsetX, y+offsetY, colorIndex)
+		img.drawHorizLine(x-offsetX, x+offsetX, y-offsetY, colorIndex)
+		img.drawHorizLine(x-offsetY, x+offsetY, y+offsetX, colorIndex)
+		img.drawHorizLine(x-offsetY, x+offsetY, y-offsetX, colorIndex)
+		if decision >= 0 {
+			offsetY--
+			decision -= 2 * offsetY
+		}
+		decision += 2*(offsetX+1) + 1
+	}
+}
+
+func (img *captchaImage) fillWithCircles(count, maxRadius int) {
+	maxX, maxY := img.Bounds().Max.X, img.Bounds().Max.Y
+	for range count {
+		colorIndex := uint8(img.randInt(1, circleCount-1))
+		radius := img.randInt(1, maxRadius)
+		img.drawCircle(img.randInt(radius, maxX-radius), img.randInt(radius, maxY-radius), radius, colorIndex)
+	}
+}
+
+func (img *captchaImage) strikeThrough() {
+	maxX, maxY := img.Bounds().Max.X, img.Bounds().Max.Y
+	y := img.randInt(maxY/3, maxY-maxY/3)
+	amplitude := img.randFloat(5, 20)
+	dx := 2.0 * math.Pi / img.randFloat(80, 180)
+	offsetX := amplitude * math.Cos(float64(y)*dx)
+	for x := range maxX {
+		offsetY := amplitude * math.Sin(float64(x)*dx)
+		for row := range img.dotSize {
+			radius := img.randInt(0, img.dotSize)
+			img.drawCircle(x+int(offsetX), y+int(offsetY)+(row*img.dotSize), radius/2, 1)
+		}
+	}
+}
+
+func (img *captchaImage) drawDigit(c byte, x, y int) {
+	if c < '0' || c > '9' {
+		return
+	}
+	digit := c - '0'
+	skew := img.randFloat(-maxSkew, maxSkew)
+	skewedX := float64(x)
+	radius := img.dotSize / 2
+	y += img.randInt(-radius, radius)
+	fontRows := fontData()
+	for row := range fontHeight {
+		for col := range fontWidth {
+			if fontRows[int(digit)*fontHeight+row][col] == '#' {
+				img.drawCircle(x+col*img.dotSize, y+row*img.dotSize, radius, 1)
+			}
+		}
+		skewedX += skew
+		x = int(skewedX)
+	}
+}
+
+func (img *captchaImage) distort(amplitude, period float64) {
+	width, height := img.Bounds().Max.X, img.Bounds().Max.Y
+	distorted := image.NewPaletted(image.Rect(0, 0, width, height), img.Palette)
+	dx := 2.0 * math.Pi / period
+	offsetsX := make([]int, height)
+	for y := range height {
+		offsetsX[y] = int(amplitude * math.Sin(float64(y)*dx))
+	}
+	for x := range width {
+		offsetY := int(amplitude * math.Cos(float64(x)*dx))
+		for y := range height {
+			distorted.SetColorIndex(x, y, img.ColorIndexAt(x+offsetsX[y], y+offsetY))
+		}
+	}
+	img.Paletted = distorted
+}

modules/imagecaptcha/imagecaptcha.go

@@ -0,0 +1,122 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package imagecaptcha
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"image/color"
+	"image/png"
+	"math/rand/v2"
+	"net/http"
+	"regexp"
+	"strconv"
+	"sync"
+
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/util"
+)
+
+const (
+	cacheKeyPrefix = "captcha_"
+	ttlSeconds     = 600
+	codeLength     = 6
+)
+
+var primaryColors = []color.RGBA{ // readable on both light and dark backgrounds
+	{R: 234, G: 67, B: 53, A: 255},
+	{R: 66, G: 133, B: 244, A: 255},
+	{R: 52, G: 168, B: 83, A: 255},
+	{R: 251, G: 188, B: 5, A: 255},
+	{R: 171, G: 71, B: 188, A: 255},
+}
+
+type pngBufferPool struct{ sync.Pool }
+
+func (p *pngBufferPool) Get() *png.EncoderBuffer {
+	buf, _ := p.Pool.Get().(*png.EncoderBuffer)
+	return buf
+}
+
+func (p *pngBufferPool) Put(buf *png.EncoderBuffer) {
+	p.Pool.Put(buf)
+}
+
+func randomCode() string {
+	s := "000000" + strconv.Itoa(util.FastCryptoRandomInt(1000000))
+	return s[len(s)-6:]
+}
+
+var globalVars = sync.OnceValue(func() (ret struct {
+	IdLength int
+	IdRegexp *regexp.Regexp
+	NoiseKey []byte
+},
+) {
+	ret.IdLength = 40
+	ret.IdRegexp = regexp.MustCompile(`^[0-9a-f]{40}$`)
+	ret.NoiseKey = util.FastCryptoRandomBytes(32)
+	return
+})
+
+// noiseRand makes refetches of an image identical, so averaging them does not remove the noise
+func noiseRand(id, code string) *rand.Rand {
+	mac := hmac.New(sha256.New, globalVars().NoiseKey)
+	_, _ = mac.Write([]byte(id + "\x00" + code))
+	return util.FastCryptoRand([32]byte(mac.Sum(nil)))
+}
+
+func CreateNew() (string, error) {
+	id := util.FastCryptoRandomHex(globalVars().IdLength)
+	_, err := PrepareCode(id, true)
+	return id, err
+}
+
+func PrepareCode(id string, generateNew bool) (code string, err error) {
+	if !globalVars().IdRegexp.MatchString(id) {
+		return "", nil
+	}
+	cacheKey := cacheKeyPrefix + id
+	if generateNew {
+		code = randomCode()
+		if err = cache.GetCache().Put(cacheKey, code, ttlSeconds); err != nil {
+			return "", err
+		}
+	} else {
+		code, _ = cache.GetCache().Get(cacheKey)
+	}
+	return code, nil
+}
+
+func Verify(id, answer string) bool {
+	if !globalVars().IdRegexp.MatchString(id) {
+		return false
+	}
+	key := cacheKeyPrefix + id
+	code, ok := cache.GetCache().Get(key)
+	_ = cache.GetCache().Delete(key)
+	return ok && answer == code
+}
+
+func ServeImage(resp http.ResponseWriter, req *http.Request) {
+	urlQuery := req.URL.Query()
+	id, reload := urlQuery.Get("id"), urlQuery.Get("reload") != ""
+	code, err := PrepareCode(id, reload)
+	if err != nil {
+		log.Error("Failed to prepare captcha code for id %s: %v", id, err)
+		http.Error(resp, "Failed to prepare captcha code", http.StatusInternalServerError)
+		return
+	} else if code == "" {
+		http.NotFound(resp, req)
+		return
+	}
+
+	resp.Header().Set("Cache-Control", "no-store")
+	resp.Header().Set("Content-Type", "image/png")
+	if req.Method == http.MethodGet {
+		pngEncoder := png.Encoder{BufferPool: &pngBufferPool{}}
+		_ = pngEncoder.Encode(resp, drawImage(noiseRand(id, code), code))
+	}
+}

modules/imagecaptcha/imagecaptcha_test.go

@@ -0,0 +1,66 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package imagecaptcha
+
+import (
+	"bytes"
+	"image"
+	"image/png"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"gitea.dev/modules/cache"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestImageCaptcha(t *testing.T) {
+	require.NoError(t, cache.Init())
+	createWithAnswer := func() (string, string) {
+		id, err := CreateNew()
+		require.NoError(t, err)
+		code, ok := cache.GetCache().Get(cacheKeyPrefix + id)
+		require.True(t, ok)
+		return id, code
+	}
+	renderImage := func(id string, refresh bool) *httptest.ResponseRecorder {
+		resp := httptest.NewRecorder()
+		reqLink := "/captcha?id=" + id
+		if refresh {
+			reqLink += "&reload=any"
+		}
+		ServeImage(resp, httptest.NewRequest(http.MethodGet, reqLink, nil))
+		return resp
+	}
+	id, answer := createWithAnswer()
+	assert.Len(t, answer, codeLength)
+	assert.True(t, Verify(id, answer))
+	assert.False(t, Verify(id, answer))
+
+	id, answer = createWithAnswer()
+	assert.False(t, Verify(id, "wrong"))
+	assert.False(t, Verify(id, answer))
+	assert.False(t, Verify("", ""))
+	assert.False(t, Verify("unknown", answer))
+
+	resp := renderImage("unknown", true)
+	assert.Equal(t, http.StatusNotFound, resp.Code)
+	_, exists := cache.GetCache().Get(cacheKeyPrefix + "unknown")
+	assert.False(t, exists)
+
+	id, _ = createWithAnswer()
+	first := renderImage(id, false)
+	decoded, err := png.Decode(bytes.NewReader(first.Body.Bytes()))
+	require.NoError(t, err)
+	assert.Equal(t, image.Rect(0, 0, imageWidth, imageHeight), decoded.Bounds())
+	second := renderImage(id, false)
+	assert.Equal(t, first.Body.Bytes(), second.Body.Bytes())
+
+	require.NoError(t, cache.GetCache().Delete(cacheKeyPrefix+id))
+	_ = renderImage(id, true)
+	_, exists = cache.GetCache().Get(cacheKeyPrefix + id)
+	assert.True(t, exists)
+}

modules/imagecaptcha/imagedata.go

@@ -0,0 +1,203 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package imagecaptcha
+
+import (
+	"strings"
+	"sync"
+)
+
+var fontData = sync.OnceValue(func() []string {
+	return strings.Fields(`
+...#####...
+..#######..
+.###...###.
+.##.....##.
+###.....##.
+##.......##
+##.......##
+##.......##
+##.......##
+##.......##
+##.......##
+##.......##
+##.......##
+##......###
+.##.....##.
+.###...###.
+..#######..
+...#####...
+
+.....##....
+....###....
+...####....
+..#####....
+..##.##....
+..#..##....
+.....##....
+.....##....
+.....##....
+.....##....
+.....##....
+.....##....
+.....##....
+.....##....
+.....##....
+.....##....
+.##########
+.##########
+
+...####....
+.########..
+###....###.
+.#......##.
+........##.
+........##.
+........##.
+.......##..
+.......##..
+......##...
+.....##....
+....###....
+...###.....
+..###......
+.###.......
+.##........
+###########
+###########
+
+..######...
+#########..
+##.....###.
+........##.
+........##.
+........##.
+......###..
+..#####....
+..#######..
+.......###.
+........###
+.........##
+.........##
+.........##
+........###
+#......###.
+#########..
+.#######...
+
+.......##..
+......###..
+.....####..
+.....#.##..
+....##.##..
+...##..##..
+...##..##..
+..##...##..
+.##....##..
+.##....##..
+##.....##..
+#......##..
+###########
+###########
+.......##..
+.......##..
+.......##..
+.......##..
+
+.#########.
+.#########.
+.##........
+.##........
+.##........
+.##........
+.#######...
+.########..
+.......###.
+........###
+.........##
+.........##
+.........##
+.........##
+........###
+##.....###.
+#########..
+..######...
+
+.....#####.
+...#######.
+..###......
+.##........
+.##........
+.#.........
+##..####...
+##.#######.
+####....##.
+###.....###
+##.......##
+##.......##
+##.......##
+##.......##
+.##.....###
+.###...###.
+..#######..
+...#####...
+
+###########
+###########
+###......##
+##......##.
+........##.
+.......###.
+.......##..
+.......##..
+......##...
+......##...
+.....###...
+.....##....
+....###....
+....##.....
+....##.....
+...###.....
+...##......
+..###......
+
+...#####...
+..########.
+.###....###
+.##......##
+.##......##
+.##......##
+..##....##.
+..#######..
+....####...
+..###.###..
+.###...###.
+###.....###
+##.......##
+##.......##
+##.......##
+###.....##.
+.#########.
+...#####...
+
+...#####...
+.########..
+.##....###.
+##......##.
+##.......##
+##.......##
+##.......##
+##......###
+.##....####
+.#######.##
+...####..##
+.........##
+........##.
+........##.
+.......###.
+......###..
+.#######...
+.#####.....
+`)
+})

modules/util/util.go

@@ -111,7 +111,7 @@ func FastCryptoRandomBytes(length int) []byte {
 	// ChaCha8 is about 20x times faster than system's crypto/rand.
 	// It is suitable for UUIDs, session IDs, etc
 	pool := chaCha8RandPool()
-	chaCha8Rand := pool.Get().(*rand2.ChaCha8) //nolint:forcetypeassert // the pool's New only ever makes *rand2.ChaCha8
+	chaCha8Rand, _ := pool.Get().(*rand2.ChaCha8)
 	defer pool.Put(chaCha8Rand)
 	buf := make([]byte, length)
 	_, _ = chaCha8Rand.Read(buf)
@@ -123,6 +123,17 @@ func FastCryptoRandomHex(length int) string {
 	return hex.EncodeToString(buf)
 }
 
+func FastCryptoRandomInt[T int | int64](n T) T {
+	pool := chaCha8RandPool()
+	chaCha8Rand, _ := pool.Get().(*rand2.ChaCha8)
+	defer pool.Put(chaCha8Rand)
+	return rand2.New(chaCha8Rand).N(n)
+}
+
+func FastCryptoRand(seed [32]byte) *rand2.Rand {
+	return rand2.New(rand2.NewChaCha8(seed))
+}
+
 // ToLowerASCII returns s with all ASCII letters mapped to their lower case.
 func ToLowerASCII(s string) string {
 	b := []byte(s)

routers/web/auth/auth.go

@@ -19,6 +19,7 @@ import (
 	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/auth/password"
 	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/imagecaptcha"
 	"gitea.dev/modules/log"
 	"gitea.dev/modules/optional"
 	"gitea.dev/modules/session"
@@ -70,7 +71,7 @@ func prepareCommonAuthPageData(ctx *context.Context, opt CommonAuthOptions) {
 		ctx.Data["McaptchaURL"] = strings.TrimSuffix(setting.Service.McaptchaURL, "/")
 		ctx.Data["CfTurnstileSitekey"] = setting.Service.CfTurnstileSitekey
 		if setting.Service.CaptchaType == setting.ImageCaptcha {
-			ctx.Data["Captcha"] = context.GetImageCaptcha()
+			ctx.Data["CreateImageCaptcha"] = imagecaptcha.CreateNew
 		}
 	}
 }
@@ -298,8 +299,7 @@ func SignInPost(ctx *context.Context) {
 	form := web.GetForm[*forms.SignInForm](ctx)
 
 	if setting.Service.EnableCaptcha && setting.Service.RequireCaptchaForLogin {
-		context.VerifyCaptcha(ctx, tplSignIn, form)
+		if !context.VerifyCaptcha(ctx, tplSignIn, form) {
-		if ctx.Written() {
 			return
 		}
 	}
@@ -553,8 +553,7 @@ func SignUpPost(ctx *context.Context) {
 		return
 	}
 
-	context.VerifyCaptcha(ctx, tplSignUp, form)
+	if !context.VerifyCaptcha(ctx, tplSignUp, form) {
-	if ctx.Written() {
 		return
 	}
 

routers/web/auth/auth_test.go

@@ -17,8 +17,10 @@ import (
 	"gitea.dev/modules/setting"
 	"gitea.dev/modules/test"
 	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
 	"gitea.dev/services/auth/source/oauth2"
 	"gitea.dev/services/contexttest"
+	"gitea.dev/services/forms"
 
 	"github.com/markbates/goth"
 	"github.com/markbates/goth/gothic"
@@ -199,3 +201,18 @@ func TestOpenIDRequireTwoFactor(t *testing.T) {
 	openIDRequireTwoFactor(ctx, user2, false, "https://example.com/id")
 	assert.False(t, ctx.Written())
 }
+
+func TestRegisterOpenIDPostRejectsWrongCaptcha(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+	defer test.MockVariableValue(&setting.Service.EnableCaptcha, true)()
+	defer test.MockVariableValue(&setting.Service.CaptchaType, setting.ImageCaptcha)()
+	sess := session.NewMockMemStore("dummy-sid-openid-register")
+	require.NoError(t, sess.Set("openid_verified_uri", "https://example.com/openid"))
+
+	ctx, _ := contexttest.MockContext(t, "POST /user/openid/register", contexttest.MockContextOption{SessionStore: sess})
+	contexttest.MockRequestPostForm(ctx.Req, url.Values{"captcha_id": {"unknown"}, "captcha": {"000000"}})
+	web.SetForm(ctx, &forms.SignUpOpenIDForm{UserName: "openid-captcha-user", Email: "openid-captcha-user@example.com"})
+	RegisterOpenIDPost(ctx)
+	assert.Equal(t, true, ctx.Data["Err_Captcha"])
+	unittest.AssertNotExistsBean(t, &user_model.User{LowerName: "openid-captcha-user"})
+}

routers/web/auth/linkaccount.go

@@ -38,6 +38,7 @@ func prepareLinkAccountPageData(ctx *context.Context) {
 	ctx.Data["ShowRegistrationButton"] = false
 	ctx.Data["DisableRegistration"] = setting.Service.DisableRegistration
 
+	// FIXME: this logic is not right: captcha is enabled, but LinkAccountPostSignIn never checks for captcha
 	prepareCommonAuthPageData(ctx, CommonAuthOptions{
 		EnableCaptcha: setting.Service.EnableCaptcha && setting.Service.RequireExternalRegistrationCaptcha,
 	})
@@ -198,8 +199,7 @@ func LinkAccountPostRegister(ctx *context.Context) {
 	}
 
 	if setting.Service.EnableCaptcha && setting.Service.RequireExternalRegistrationCaptcha {
-		context.VerifyCaptcha(ctx, tplLinkAccount, form)
+		if !context.VerifyCaptcha(ctx, tplLinkAccount, form) {
-		if ctx.Written() {
 			return
 		}
 	}

routers/web/auth/openid.go

@@ -378,7 +378,9 @@ func RegisterOpenIDPost(ctx *context.Context) {
 			ctx.ServerError("", err)
 			return
 		}
-		context.VerifyCaptcha(ctx, tplSignUpOID, form)
+		if !context.VerifyCaptcha(ctx, tplSignUpOID, form) {
+			return
+		}
 	}
 
 	length := max(setting.MinPasswordLength, 256)

routers/web/web.go

@@ -13,6 +13,7 @@ import (
 	"gitea.dev/models/unit"
 	"gitea.dev/modules/git"
 	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/imagecaptcha"
 	"gitea.dev/modules/log"
 	"gitea.dev/modules/metrics"
 	"gitea.dev/modules/public"
@@ -50,7 +51,6 @@ import (
 
 	_ "gitea.dev/modules/session" // to register all internal adapters
 
-	"gitea.com/go-chi/captcha"
 	chi_middleware "github.com/go-chi/chi/v5/middleware"
 	"github.com/go-chi/cors"
 	"github.com/klauspost/compress/gzhttp"
@@ -293,9 +293,8 @@ func Routes() *web.Router {
 		mid = append(mid, wrapper)
 	}
 
-	if setting.Service.EnableCaptcha {
+	if setting.Service.EnableCaptcha && setting.Service.CaptchaType == setting.ImageCaptcha {
-		// The captcha http.Handler should only fire on /captcha/* so we can just mount this on that url
+		routes.Methods("GET,HEAD", `/captcha`, append(mid, imagecaptcha.ServeImage)...)
-		routes.Methods("GET,HEAD", "/captcha/*", append(mid, captcha.Captchaer(context.GetImageCaptcha()))...)
 	}
 
 	if setting.Metrics.Enabled {

services/context/captcha.go

@@ -5,65 +5,37 @@ package context
 
 import (
 	"fmt"
-	"image/color"
-	"sync"
 
-	"gitea.dev/modules/cache"
 	"gitea.dev/modules/hcaptcha"
+	"gitea.dev/modules/imagecaptcha"
 	"gitea.dev/modules/log"
 	"gitea.dev/modules/mcaptcha"
 	"gitea.dev/modules/recaptcha"
 	"gitea.dev/modules/setting"
 	"gitea.dev/modules/templates"
 	"gitea.dev/modules/turnstile"
-
-	"gitea.com/go-chi/captcha"
 )
 
-var (
-	imageCaptchaOnce sync.Once
-	cpt              *captcha.Captcha
-)
-
-// GetImageCaptcha returns global image captcha
-func GetImageCaptcha() *captcha.Captcha {
-	imageCaptchaOnce.Do(func() {
-		cpt = captcha.NewCaptcha(captcha.Options{
-			SubURL: setting.AppSubURL,
-			// Use a color palette with high contrast colors suitable for both light and dark modes
-			// These colors provide good visibility and readability in both themes
-			ColorPalette: color.Palette{
-				color.RGBA{R: 234, G: 67, B: 53, A: 255},  // Bright red
-				color.RGBA{R: 66, G: 133, B: 244, A: 255}, // Medium blue
-				color.RGBA{R: 52, G: 168, B: 83, A: 255},  // Green
-				color.RGBA{R: 251, G: 188, B: 5, A: 255},  // Yellow/gold
-				color.RGBA{R: 171, G: 71, B: 188, A: 255}, // Purple
-			},
-		})
-		cpt.Store = cache.GetCache().ChiCache()
-	})
-	return cpt
-}
-
 const (
+	imageCaptchaIDField      = "captcha_id"
+	imageCaptchaAnswerField  = "captcha"
 	gRecaptchaResponseField  = "g-recaptcha-response"
 	hCaptchaResponseField    = "h-captcha-response"
 	mCaptchaResponseField    = "mcaptcha__token" // this form key is hard-coded in the mcaptcha frontend library
 	cfTurnstileResponseField = "cf-turnstile-response"
 )
 
-// VerifyCaptcha verifies Captcha data
+// VerifyCaptcha returns whether the captcha is solved or disabled, otherwise it renders tpl with an error
-// No-op if captchas are not enabled
+func VerifyCaptcha(ctx *Context, tpl templates.TplName, form any) bool {
-func VerifyCaptcha(ctx *Context, tpl templates.TplName, form any) {
 	if !setting.Service.EnableCaptcha {
-		return
+		return true
 	}
 
 	var valid bool
 	var err error
 	switch setting.Service.CaptchaType {
 	case setting.ImageCaptcha:
-		valid = GetImageCaptcha().VerifyReq(ctx.Req)
+		valid = imagecaptcha.Verify(ctx.FormString(imageCaptchaIDField), ctx.FormString(imageCaptchaAnswerField))
 	case setting.ReCaptcha:
 		valid, err = recaptcha.Verify(ctx, ctx.Req.Form.Get(gRecaptchaResponseField))
 	case setting.HCaptcha:
@@ -74,7 +46,7 @@ func VerifyCaptcha(ctx *Context, tpl templates.TplName, form any) {
 		valid, err = turnstile.Verify(ctx, ctx.Req.Form.Get(cfTurnstileResponseField))
 	default:
 		ctx.ServerError("Unknown Captcha Type", fmt.Errorf("unknown Captcha Type: %s", setting.Service.CaptchaType))
-		return
+		return false
 	}
 	if err != nil {
 		log.Debug("Captcha Verify failed: %v", err)
@@ -83,5 +55,7 @@ func VerifyCaptcha(ctx *Context, tpl templates.TplName, form any) {
 	if !valid {
 		ctx.Data["Err_Captcha"] = true
 		ctx.RenderWithErrDeprecated(ctx.Tr("form.captcha_incorrect"), tpl, form)
+		return false
 	}
+	return true
 }

templates/user/auth/captcha.tmpl

@@ -1,10 +1,12 @@
 {{if .EnableCaptcha}}{{if eq .CaptchaType "image"}}
+	{{$captchaID := call .CreateImageCaptcha}}
 	<div class="inline field tw-text-center">
-		{{.Captcha.CreateHTML}}
+		<input type="hidden" name="captcha_id" value="{{$captchaID}}">
+		<img class="tw-cursor-pointer" src="{{AppSubUrl}}/captcha?id={{$captchaID}}" width="240" height="80" alt="{{ctx.Locale.Tr "captcha"}}" data-global-click="onImageCaptchaReload">
 	</div>
 	<div class="required field {{if .Err_Captcha}}error{{end}}">
 		<label for="captcha">{{ctx.Locale.Tr "captcha"}}</label>
-		<input id="captcha" name="captcha" value="{{.captcha}}" autocomplete="off">
+		<input id="captcha" name="captcha" autocomplete="off">
 	</div>
 {{else if eq .CaptchaType "recaptcha"}}
 	<div class="inline field tw-text-center required">

tests/integration/signup_test.go

@@ -12,9 +12,11 @@ import (
 	"gitea.dev/models/db"
 	"gitea.dev/models/unittest"
 	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/cache"
 	"gitea.dev/modules/setting"
 	"gitea.dev/modules/test"
 	"gitea.dev/modules/translation"
+	"gitea.dev/routers"
 	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
@@ -35,6 +37,35 @@ func TestSignup(t *testing.T) {
 	// should be able to view new user's page
 	req = NewRequest(t, "GET", "/exampleUser")
 	MakeRequest(t, req, http.StatusOK)
+
+	t.Run("ImageCaptcha", func(t *testing.T) {
+		defer test.MockVariableValue(&setting.Service.EnableCaptcha, true)()
+		defer test.MockVariableValue(&setting.Service.CaptchaType, setting.ImageCaptcha)()
+		defer test.MockVariableValue(&testWebRoutes, routers.NormalRoutes())()
+
+		resp := MakeRequest(t, NewRequest(t, "GET", "/user/sign_up"), http.StatusOK)
+		captchaID := NewHTMLParser(t, resp.Body).GetInputValueByName("captcha_id")
+		resp = MakeRequest(t, NewRequest(t, "GET", "/captcha?id="+captchaID), http.StatusOK)
+		assert.Equal(t, "image/png", resp.Header().Get("Content-Type"))
+		assert.Equal(t, "no-store", resp.Header().Get("Cache-Control"))
+
+		values := map[string]string{
+			"user_name":  "captchaUser",
+			"email":      "captchaUser@example.com",
+			"password":   "examplePassword!1",
+			"retype":     "examplePassword!1",
+			"captcha_id": captchaID,
+			"captcha":    "wrong",
+		}
+		resp = MakeRequest(t, NewRequestWithValues(t, "POST", "/user/sign_up", values), http.StatusOK)
+		htmlDoc := NewHTMLParser(t, resp.Body)
+		assert.Equal(t, translation.NewLocale("en-US").TrString("form.captcha_incorrect"), strings.TrimSpace(htmlDoc.Find(".ui.message").Text()))
+
+		values["captcha_id"] = htmlDoc.GetInputValueByName("captcha_id")
+		captchaCode, _ := cache.GetCache().Get("captcha_" + values["captcha_id"])
+		values["captcha"] = captchaCode
+		MakeRequest(t, NewRequestWithValues(t, "POST", "/user/sign_up", values), http.StatusSeeOther)
+	})
 }
 
 func TestSignupAsRestricted(t *testing.T) {

web_src/js/features/captcha.ts

@@ -1,6 +1,13 @@
 import {isDarkTheme} from '../utils.ts';
+import {registerGlobalEventFunc} from '../modules/observer.ts';
 
 export async function initCaptcha() {
+  registerGlobalEventFunc('click', 'onImageCaptchaReload', (img: HTMLImageElement) => {
+    const url = new URL(img.src);
+    url.searchParams.set('reload', String(Date.now()));
+    img.src = url.href;
+  });
+
   const captchaEl = document.querySelector('#captcha');
   if (!captchaEl) return;