From 197c75a02560ff153d73d3fe218fed312ccceaa4 Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Tue, 27 Jan 2026 09:41:08 -0800
Subject: skip captcha for tor

---
 routes/users.ts | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/routes/users.ts b/routes/users.ts
index 60fe02f5..a00c16fe 100644
--- a/routes/users.ts
+++ b/routes/users.ts
@@ -30,6 +30,10 @@ const verifyRecaptcha = async (response, req?) => {
   const { recaptcha: secret } = config;
   if (!secret) return true;
 
+  // Skip captcha for Tor users accessing via .onion
+  const host = req?.headers?.["host"] || "";
+  if (host.endsWith(".onion")) return true;
+
   // Check for valid API key to bypass captcha
   const apiKey = req?.headers?.["x-api-key"];
   if (apiKey && (await db.sIsMember("apikeys", apiKey))) {
-- 
cgit v1.2.3