Design a CAPTCHA Service
MediumSystem design · Security
Design a CAPTCHA and bot-detection service that websites embed on risky actions such as sign-up, login and checkout. Most real users should pass invisibly, suspicious traffic gets challenged, and the customer's backend verifies the result server-side.
In scope: risk scoring, challenge issuance and grading, token design and verification, replay and solver-farm resistance, accessibility, and failure modes. Out of scope: general WAF or DDoS protection.
Requirements
- Score risk first and challenge only the uncertain minority, escalating proportionally
- Tokens are single-use, short-lived and bound to the site and action; the answer never reaches the client
- Provide accessible alternatives and a path forward that does not depend on solving
- Define fail-open or fail-closed behaviour per customer action when the service is unavailable