Address input blocked in checkout when plugin is active (Shopware 6.7.5.1)

[lederwerkstatt-beep]

Question

When FroshAltchaCaptcha is enabled, entering or editing addresses during checkout is blocked. The address form fields become unusable.
Environment:

Shopware 6.7.5.1
FroshAltchaCaptcha (latest version)
DHL Shipping Plugin 3.11.0

Possible cause:
The issue might be related to a conflict with the DHL Shipping plugin, which also interacts with address forms.
Feature request:
It would be helpful to have an option to enable Altcha only for specific forms (e.g., contact form only) rather than globally. This would allow using the captcha protection where needed without affecting checkout functionality.

[tinect]

Without the DHL Shipping Plugin it works? IIRC, no captcha is used in address form on standard installation.

Regarding your Feature request:
This Plugin registers a Captcha for Shopware default features. So your feature request might better fit to Shopware.

[tinect]

I just had a few moments to look into the plugin PickwareDHL 3.11.0. I am not familiar with DHL and have no account for testing, but I could not find any captcha usage in that plugin.

Is there any other plugin adding captcha usages on your side?

[lederwerkstatt-beep]

For the test, I first had to set up a stage. I deactivated DHL and then PayPal. But even after that, I was still unable to submit the completed address form. The verification was not completed in any case. I usually use Honeypot. Otherwise, no other captcha.

[tinect]

this males totally sense. Because the honeypot is valid when there is no input.
Okay, but where does the captcha for addresses come from?

additionally, can you send some screenshots what happens and how it looks like?is there any issue in console?

[lederwerkstatt-beep]

I proceed as follows:

• In the SW6 backend, Settings/Master data under Captcha: Altcha Captcha
• onload
• No captcha for logged-in customers: on
• Hide Altcha footer: off
• Hide Altcha logo: off
• Floating UI: off
• Captcha invisible: off

In the frontend as a non-logged-in customer:

• Add items to shopping cart
• Click to checkout
• Shipping information page opens, the captcha is already visible at the bottom with the message: being checked and a spinning circle
• Enter address details
  Captcha remains unchanged, clicking on the “continue” button has no effect.

[tinect]

Ah, you mean the order by guest. I could not reproduce your problem:
https://github.com/user-attachments/assets/12ffd75e-a44e-4658-8ec1-468c572007d9

Let us try to get more into the issue.

1. What do you mean with Captcha remains unchanged?
2. What browser in which version do you use?
3. Is there any issue in the developer console?
4. Does it work without your checkout-plugin?

[lederwerkstatt-beep]

Problem: Altcha Widget not working due to Content-Security-Policy (CSP)
Environment:

Shopware 6.7.5
Altcha Plugin

Symptom:
The Altcha captcha does not load correctly. The browser console shows the following errors:
Content-Security-Policy: The page's settings blocked the loading of a worker script (worker-src) at blob:https://example.com/... because it violates the following directive: "script-src 'self' 'unsafe-inline' 'unsafe-eval' ..."

Cause:
The Altcha widget uses Web Workers that are created as Blob URLs (blob:https://...). When a Content-Security-Policy is defined without an explicit worker-src directive, the browser falls back to the script-src directive. Since blob: is not allowed there, the workers are blocked.

Solution:
The CSP must be extended with a worker-src directive that allows blob::
worker-src 'self' blob:;
Example of a complete CSP header (in .htaccess):
apacheHeader always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' ...; worker-src 'self' blob:; object-src 'none'"

Recommendation:
It would be helpful to include this information in the plugin documentation, as many shop owners use CSP headers for security purposes and the captcha will not work without this adjustment.

Thank you so much for your work on this plugin – especially on New Year's Eve! Wishing you a happy and successful New Year 2026!

Armin

[tinect]

Thank you. I am happy this is no issue of the plugin.

Stay safe and a happy new year.