invisible_captcha 0.10.0 → 2.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 0b8877b6b9e63a8e3469df1b1e4d564c323798f4
-  data.tar.gz: aa93c8cd7004683493f06ba0513bc4cce274f261
+SHA256:
+  metadata.gz: 86acfe71e903568702c63c261bfd32a066dbc947d1c2fa2b4956178a7de591db
+  data.tar.gz: a9a8768c5bcfb9a7656e0638dde4bf40e169719385bf947dace7fa4d34f03656
 SHA512:
-  metadata.gz: 32dca9e9c96528181b6665854d07b2edba9441390613824975617f26d263e747475688979224f09d6b582c3c762fa4f438517924534f361ffc7d266ca78d3d39
-  data.tar.gz: f8a13ba2c4885e921668617788d751050ae47a86714c6537a645fbb40071996634a603f31f4a6ff1cdbe723bfc2dbf940a9f82874306baaf98728ea1f8c23cba
+  metadata.gz: ec1ed1b9f7bef2e753f7b736dbce8124b5cd4c699e4075cbd15fdade99e6f332025e3088f0754315b18f8bde48b7e883c3470f840a535a3631f2e5c659c415df
+  data.tar.gz: 3698ed54f31c8f87730dcd92e14c2076e10aaa98a14a765e7d3be8bfd0e259385572b5d3252b8328fb4a539634bb8e086270b2e7e34117ab76a15ab4f42c095b

data/.gitignore

@@ -8,3 +8,4 @@ Gemfile.lock
 spec/dummy/log/*.log
 spec/dummy/tmp/
 .byebug_history
+.DS_Store

data/.rspec

@@ -0,0 +1,3 @@
+--format documentation
+--color
+--require spec_helper

data/.travis.yml

@@ -1,31 +1,18 @@
 language: ruby
 cache: bundler
-sudo: false
 rvm:
   - ruby-head
-  - 2.4.2
-  - 2.3.5
-  - 2.2.8
-  - 2.1.10
+  - 3.0.0
+  - 2.7.2
+  - 2.6.5
+  - 2.5.8
 gemfile:
-  - gemfiles/rails_5.1.gemfile
-  - gemfiles/rails_5.0.gemfile
-  - gemfiles/rails_4.2.gemfile
-  - gemfiles/rails_4.1.gemfile
-  - gemfiles/rails_3.2.gemfile
+  - gemfiles/rails_6.1.gemfile
+  - gemfiles/rails_6.0.gemfile
+  - gemfiles/rails_5.2.gemfile
 matrix:
   exclude:
-    - rvm: 2.1.10
-      gemfile: gemfiles/rails_5.0.gemfile
-    - rvm: 2.1.10
-      gemfile: gemfiles/rails_5.1.gemfile
-    - rvm: 2.4.2
-      gemfile: gemfiles/rails_4.1.gemfile
-    - rvm: 2.4.2
-      gemfile: gemfiles/rails_3.2.gemfile
-    - rvm: ruby-head
-      gemfile: gemfiles/rails_4.1.gemfile
-    - rvm: ruby-head
-      gemfile: gemfiles/rails_3.2.gemfile
+    - rvm: 3.0.0
+      gemfile: gemfiles/rails_5.2.gemfile
   allow_failures:
-    - rvm: ruby-head
+    - rvm: ruby-head

data/Appraisals

@@ -1,19 +1,11 @@
-appraise "rails-5.1" do
-  gem "rails", "~> 5.1.0"
+appraise "rails-6.1" do
+  gem "rails", "~> 6.1.0"
 end
 
-appraise "rails-5.0" do
-  gem "rails", "~> 5.0.0"
+appraise "rails-6.0" do
+  gem "rails", "~> 6.0.0"
 end
 
-appraise "rails-4.2" do
-  gem "rails", github: 'rails/rails', branch: '4-2-stable'
+appraise "rails-5.2" do
+  gem "rails", "~> 5.2.0"
 end
-
-appraise "rails-4.1" do
-  gem "rails", "~> 4.1.0"
-end
-
-appraise "rails-3.2" do
-  gem "rails", "~> 3.2.0"
-end

data/CHANGELOG.md

@@ -0,0 +1,151 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+## [2.0.0]
+
+- New spinner, IP based, validation check (#89)
+- Drop official support for unmaintained Rails versions: 5.1, 5.0 and 4.2 (#86)
+- Drop official support for EOL Rubies: 2.4 and 2.3 (#86)
+
+## [1.1.0]
+
+- New option `prepend: true` for the controller macro (#77)
+
+## [1.0.1]
+
+- Fix naming issue with Ruby 2.7 (#65)
+
+## [1.0.0]
+
+- Remove Ruby 2.2 and Rails 3.2 support
+- Add Instrumentation event (#62)
+
+## [0.13.0]
+
+- Add support for the Content Security Policy nonce (#61)
+- Freeze all strings (#60)
+
+## [0.12.2]
+
+- Allow new timestamp to be set during `on_timestamp_spam` callback (#53)
+
+## [0.12.1]
+
+- Clear timestamp stored in `session[:invisible_captcha_timestamp]` (#50)
+- Rails 6 support
+
+## [0.12.0]
+
+- Honeypot input with autocomplete="off" by default (#42)
+
+## [0.11.0]
+
+- Improve logging (#40, #41)
+- Official Rails 5.2 support
+- Drop Ruby 2.1 from CI
+
+## [0.10.0]
+
+- New timestamp on each request to avoid stale timestamps (#24)
+- Allow to inject styles manually anywhere in the layout (#27)
+- Allow to change threshold per action
+- Dynamic css strategy to hide the honeypot
+- Remove Ruby 1.9 support
+- Random default honeypots on each restart
+- Allow to pass html_options to honeypot input (#28)
+- Improvements on demo application and tests
+- Better strong parameters interaction (#30, #33)
+
+## [0.9.3]
+
+- Rails 5.1 support (#29)
+- Modernize CI Rubies
+
+## [0.9.2]
+
+- Rails 5.0 official support (#23)
+- Travis CI matrix improvements
+
+## [0.9.1]
+
+- Add option (`timestamp_enabled`) to disable timestamp check (#22)
+
+## [0.9.0]
+
+- Remove model style validations (#14)
+- Consider as spam if timestamp not in session (#11)
+- Allow to define a different threshold per action (#8)
+- Appraisals integration (#8)
+- CI improvements: use new Travis infrastructure (#8)
+
+## [0.8.2]
+
+- Default timestamp action redirects to back (#19)
+- Stores timestamps as string in session (#17)
+
+## [0.8.1]
+
+- Time-sensitive form submissions (#7)
+- I18n integration (#13)
+
+## [0.8.0]
+
+- Better Rails integration with `ActiveSupport.on_load` callbacks (#5)
+- Allow to override settings via the view helper (#5)
+
+## [0.7.0]
+
+- Revamped code base to allow more customizations (#2)
+- Added basic specs (#2)
+- Travis integration (#2)
+- Demo app (#2)
+
+## [0.6.5]
+
+- Stop using Jeweler
+
+## [0.6.4]
+
+- Docs! (#1)
+
+## [0.6.3]
+
+- Internal re-naming
+
+## [0.6.2]
+
+- Fix gem initialization
+
+## [0.6.0]
+
+- Allow to configure via `InvisibleCaptcha.setup` block
+
+## [0.5.0]
+
+- First version of controller filters
+
+[2.0.0]: https://github.com/markets/invisible_captcha/compare/v1.1.0...v2.0.0
+[1.1.0]: https://github.com/markets/invisible_captcha/compare/v1.0.1...v1.1.0
+[1.0.1]: https://github.com/markets/invisible_captcha/compare/v1.0.0...v1.0.1
+[1.0.0]: https://github.com/markets/invisible_captcha/compare/v0.13.0...v1.0.0
+[0.13.0]: https://github.com/markets/invisible_captcha/compare/v0.12.2...v0.13.0
+[0.12.2]: https://github.com/markets/invisible_captcha/compare/v0.12.1...v0.12.2
+[0.12.1]: https://github.com/markets/invisible_captcha/compare/v0.12.0...v0.12.1
+[0.12.0]: https://github.com/markets/invisible_captcha/compare/v0.11.0...v0.12.0
+[0.11.0]: https://github.com/markets/invisible_captcha/compare/v0.10.0...v0.11.0
+[0.10.0]: https://github.com/markets/invisible_captcha/compare/v0.9.3...v0.10.0
+[0.9.3]: https://github.com/markets/invisible_captcha/compare/v0.9.2...v0.9.3
+[0.9.2]: https://github.com/markets/invisible_captcha/compare/v0.9.1...v0.9.2
+[0.9.1]: https://github.com/markets/invisible_captcha/compare/v0.9.0...v0.9.1
+[0.9.0]: https://github.com/markets/invisible_captcha/compare/v0.8.2...v0.9.0
+[0.8.2]: https://github.com/markets/invisible_captcha/compare/v0.8.1...v0.8.2
+[0.8.1]: https://github.com/markets/invisible_captcha/compare/v0.8.0...v0.8.1
+[0.8.0]: https://github.com/markets/invisible_captcha/compare/v0.7.0...v0.8.0
+[0.7.0]: https://github.com/markets/invisible_captcha/compare/v0.6.5...v0.7.0
+[0.6.5]: https://github.com/markets/invisible_captcha/compare/v0.6.4...v0.6.5
+[0.6.4]: https://github.com/markets/invisible_captcha/compare/v0.6.3...v0.6.4
+[0.6.3]: https://github.com/markets/invisible_captcha/compare/v0.6.2...v0.6.3
+[0.6.2]: https://github.com/markets/invisible_captcha/compare/v0.6.0...v0.6.2
+[0.6.0]: https://github.com/markets/invisible_captcha/compare/v0.5.0...v0.6.0
+[0.5.0]: https://github.com/markets/invisible_captcha/compare/v0.4.1...v0.5.0

data/Gemfile

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 source 'https://rubygems.org'
 
 gemspec

data/LICENSE

@@ -1,4 +1,4 @@
-Copyright 2012-2017 Marc Anguera Insa
+Copyright 2012-2021 Marc Anguera Insa
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

data/README.md

@@ -1,37 +1,34 @@
 # Invisible Captcha
 
-[![Gem Version](https://badge.fury.io/rb/invisible_captcha.svg)](http://badge.fury.io/rb/invisible_captcha) [![Build Status](https://travis-ci.org/markets/invisible_captcha.svg)](https://travis-ci.org/markets/invisible_captcha)
+[![Gem](https://img.shields.io/gem/v/invisible_captcha.svg?style=flat-square)](https://rubygems.org/gems/invisible_captcha)
+[![Build Status](https://travis-ci.com/markets/invisible_captcha.svg?branch=master)](https://travis-ci.com/markets/invisible_captcha)
 
-> Simple and flexible spam protection solution for Rails applications.
+> Complete and flexible spam protection solution for Rails applications.
 
 Invisible Captcha provides different techniques to protect your application against spambots.
 
-The main protection is a solution based on the `honeypot` principle, which provides a better user experience, since there is no extra steps for real users, but for the bots.
+The main protection is a solution based on the `honeypot` principle, which provides a better user experience since there are no extra steps for real users, only for the bots.
 
 Essentially, the strategy consists on adding an input field :honey_pot: into the form that:
 
-* shouldn't be visible by the real users
-* should be left empty by the real users
-* will most be filled by spam bots
+- shouldn't be visible by the real users
+- should be left empty by the real users
+- will most likely be filled by spam bots
 
-It also comes with a time-sensitive :hourglass: form submission.
+It also comes with:
+- a time-sensitive :hourglass: form submission
+- an IP based :mag: spinner validation
 
 ## Installation
 
-Invisible Captcha is tested against Rails `>= 3.2` and Ruby `>= 2.1`.
+Invisible Captcha is tested against Rails `>= 5.2` and Ruby `>= 2.5`.
 
-Add this line to you Gemfile:
+Add this line to your Gemfile and then execute `bundle install`:
 
-```
+```ruby
 gem 'invisible_captcha'
 ```
 
-Or install the gem manually:
-
-```
-$ gem install invisible_captcha
-```
-
 ## Usage
 
 View code:
@@ -52,7 +49,7 @@ class TopicsController < ApplicationController
 end
 ```
 
-This method will act as a `before_action` that triggers when spam is detected (honeypot field has some value). By default it responds with no content (only headers: `head(200)`). This is a good default, since the bot will surely read the response code and will think that it has achieved to submit the form properly. But, anyway, you are able to define your own callback by passing a method to the `on_spam` option:
+This method will act as a `before_action` that triggers when spam is detected (honeypot field has some value). By default, it responds with no content (only headers: `head(200)`). This is a good default, since the bot will surely read the response code and will think that it has achieved to submit the form properly. But, anyway, you can define your own callback by passing a method to the `on_spam` option:
 
 ```ruby
 class TopicsController < ApplicationController
@@ -66,7 +63,7 @@ class TopicsController < ApplicationController
 end
 ```
 
-Note that is not mandatory to specify a `honeypot` attribute (nor in the view, nor in the controller). In this case, the engine will take a random field from `InvisibleCaptcha.honeypots`. So, if you're integrating it following this path, in your form:
+Note that it is not mandatory to specify a `honeypot` attribute (neither in the view nor in the controller). In this case, the engine will take a random field from `InvisibleCaptcha.honeypots`. So, if you're integrating it following this path, in your form:
 
 ```erb
 <%= form_tag(new_contact_path) do |f| %>
@@ -74,12 +71,32 @@ Note that is not mandatory to specify a `honeypot` attribute (nor in the view, n
 <% end %>
 ```
 
-In you controller:
+In your controller:
 
 ```
 invisible_captcha only: [:new_contact]
 ```
 
+`invisible_captcha` sends all messages to `flash[:error]`. For messages to appear on your pages, add `<%= flash[:error] %>` to `app/views/layouts/application.html.erb` (somewhere near the top of your `<body>` element):
+
+```erb
+<!DOCTYPE html>
+<html>
+<head>
+  <title>Yet another Rails app</title>
+  <%= stylesheet_link_tag    "application", media: "all" %>
+  <%= javascript_include_tag "application" %>
+  <%= csrf_meta_tags %>
+</head>
+<body>
+  <%= flash[:error] %>
+  <%= yield %>
+</body>
+</html>
+```
+
+You can place `<%= flash[:error] %>` next to `:alert` and `:notice` message types, if you have them in your `app/views/layouts/application.html.erb`.
+
 ## Options and customization
 
 This section contains a description of all plugin options and customizations.
@@ -88,13 +105,15 @@ This section contains a description of all plugin options and customizations.
 
 You can customize:
 
-* `sentence_for_humans`: text for real users if input field was visible. By default, it uses I18n (see below).
-* `honeypots`: collection of default honeypots. Used by the view helper, called with no args, to generate a random honeypot field name. By default, a random collection is already generated.
-* `visual_honeypots`: make honeypots visible, also useful to test/debug your implementation.
-* `timestamp_threshold`: fastest time (in seconds) to expect a human to submit the form (see [original article by Yoav Aner](http://blog.gingerlime.com/2012/simple-detection-of-comment-spam-in-rails/) outlining the idea). By default, 4 seconds. **NOTE:** It's recommended to deactivate the autocomplete feature to avoid false positives (`autocomplete="off"`).
-* `timestamp_enabled`: option to disable the time threshold check at application level. Could be useful, for example, on some testing scenarios. By default, true.
-* `timestamp_error_message`: flash error message thrown when form submitted quicker than the `timestamp_threshold` value. It uses I18n by default.
-* `injectable_styles`: if enabled, you should call anywhere in your layout the following helper `<%= invisible_captcha_styles %>`. This allows you to inject styles, for example, in `<head>`. False by default, styles are injected inline with the honeypot.
+- `sentence_for_humans`: text for real users if input field was visible. By default, it uses I18n (see below).
+- `honeypots`: collection of default honeypots. Used by the view helper, called with no args, to generate a random honeypot field name. By default, a random collection is already generated. As the random collection is stored in memory, it will not work if you are running multiple Rails instances behind a load balancer. See [Multiple Rails instances](#multiple-rails-instances).
+- `visual_honeypots`: make honeypots visible, also useful to test/debug your implementation.
+- `timestamp_threshold`: fastest time (in seconds) to expect a human to submit the form (see [original article by Yoav Aner](https://blog.gingerlime.com/2012/simple-detection-of-comment-spam-in-rails/) outlining the idea). By default, 4 seconds. **NOTE:** It's recommended to deactivate the autocomplete feature to avoid false positives (`autocomplete="off"`).
+- `timestamp_enabled`: option to disable the time threshold check at application level. Could be useful, for example, on some testing scenarios. By default, true.
+- `timestamp_error_message`: flash error message thrown when form submitted quicker than the `timestamp_threshold` value. It uses I18n by default.
+- `injectable_styles`: if enabled, you should call anywhere in your layout the following helper `<%= invisible_captcha_styles %>`. This allows you to inject styles, for example, in `<head>`. False by default, styles are injected inline with the honeypot.
+- `spinner_enabled`: option to disable the IP spinner validation.
+- `secret`: customize the secret key to encode some internal values. By default, it reads the environment variable `ENV['INVISIBLE_CAPTCHA_SECRET']` and fallbacks to random value. Be careful, if you are running multiple Rails instances behind a load balancer, use always the same value via the environment variable.
 
 To change these defaults, add the following to an initializer (recommended `config/initializers/invisible_captcha.rb`):
 
@@ -102,9 +121,10 @@ To change these defaults, add the following to an initializer (recommended `conf
 InvisibleCaptcha.setup do |config|
   # config.honeypots           << ['more', 'fake', 'attribute', 'names']
   # config.visual_honeypots    = false
-  # config.timestamp_threshold = 4
+  # config.timestamp_threshold = 2
   # config.timestamp_enabled   = true
   # config.injectable_styles   = false
+  # config.spinner_enabled     = true
 
   # Leave these unset if you want to use I18n (see below)
   # config.sentence_for_humans     = 'If you are a human, ignore this field'
@@ -112,28 +132,52 @@ InvisibleCaptcha.setup do |config|
 end
 ```
 
+#### Multiple Rails instances
+
+If you have multiple Rails instances running behind a load balancer, you have to share the same honeypots collection between the instances.
+
+Either use a fixed collection or share them between the instances using `Rails.cache`:
+
+```ruby
+InvisibleCaptcha.setup do |config|
+  config.honeypots = Rails.cache.fetch('invisible_captcha_honeypots') do
+    (1..20).map { InvisibleCaptcha.generate_random_honeypot }
+  end
+end
+```
+
+Be careful also with the `secret` setting. Since it will be stored in-memory, if you are running this setup, the best idea is to provide the environment variable (`ENV['INVISIBLE_CAPTCHA_SECRET']`) from your infrastructure.
+
 ### Controller method options:
 
 The `invisible_captcha` method accepts some options:
 
-* `only`: apply to given controller actions.
-* `except`: exclude to given controller actions.
-* `honeypot`: name of custom honeypot.
-* `scope`: name of scope, ie: 'topic[subtitle]' -> 'topic' is the scope.
-* `on_spam`: custom callback to be called on spam detection.
-* `timestamp_threshold`: enable/disable this technique at action level.
-* `on_timestamp_spam`: custom callback to be called when form submitted too quickly. The default action redirects to `:back` printing a warning in `flash[:error]`.
-* `timestamp_threshold`: custom threshold per controller/action. Overrides the global value for `InvisibleCaptcha.timestamp_threshold`.
+- `only`: apply to given controller actions.
+- `except`: exclude to given controller actions.
+- `honeypot`: name of custom honeypot.
+- `scope`: name of scope, ie: 'topic[subtitle]' -> 'topic' is the scope. By default, it's inferred from the `controller_name`.
+- `on_spam`: custom callback to be called on spam detection.
+- `timestamp_enabled`: enable/disable this technique at action level.
+- `on_timestamp_spam`: custom callback to be called when form submitted too quickly. The default action redirects to `:back` printing a warning in `flash[:error]`.
+- `timestamp_threshold`: custom threshold per controller/action. Overrides the global value for `InvisibleCaptcha.timestamp_threshold`.
+- `prepend`: the spam detection will run in a `prepend_before_action` if `prepend: true`, otherwise will run in a `before_action`.
 
 ### View helpers options:
 
-Using the view/form helper you can override some defaults for the given instance. Actually, it allows to change: `sentence_for_humans` and `visual_honeypots`.
+Using the view/form helper you can override some defaults for the given instance. Actually, it allows to change:
+
+- `sentence_for_humans`
 
 ```erb
 <%= form_for(@topic) do |f| %>
-  <%= f.invisible_captcha :subtitle, visual_honeypots: true, sentence_for_humans: "hey! leave this input empty!" %>
-  <!-- or -->
-  <%= invisible_captcha visual_honeypots: true, sentence_for_humans: "hey! leave this input empty!" %>
+  <%= f.invisible_captcha :subtitle, sentence_for_humans: "hey! leave this input empty!" %>
+<% end %>
+```
+- `visual_honeypots`
+
+```erb
+<%= form_for(@topic) do |f| %>
+  <%= f.invisible_captcha :subtitle, visual_honeypots: true %>
 <% end %>
 ```
 
@@ -143,6 +187,71 @@ You can also pass html options to the input:
 <%= invisible_captcha :subtitle, :topic, id: "your_id", class: "your_class" %>
 ```
 
+### Spam detection notifications
+
+In addition to the `on_spam` controller callback, you can use the [Active Support Instrumentation API](https://guides.rubyonrails.org/active_support_instrumentation.html) to set up a global event handler that fires whenever spam is detected. This is useful for advanced logging, background processing, etc.
+
+To set up a global event handler, [subscribe](https://guides.rubyonrails.org/active_support_instrumentation.html#subscribing-to-an-event) to the `invisible_captcha.spam_detected` event in an initializer:
+
+```ruby
+# config/initializers/invisible_captcha.rb
+
+ActiveSupport::Notifications.subscribe('invisible_captcha.spam_detected') do |*args, data|
+  AwesomeLogger.warn(data[:message], data) # Log to an external logging service.
+  SpamRequest.create(data)                 # Record the blocked request in your database.
+end
+```
+
+The `data` passed to the subscriber is hash containing information about the request that was detected as spam. For example:
+
+```ruby
+{
+  message: "Invisible Captcha honeypot param 'subtitle' was present.",
+  remote_ip: '127.0.0.1',
+  user_agent: 'Chrome 77',
+  controller: 'users',
+  action: 'create',
+  url: 'http://example.com/users',
+  params: {
+    topic: { subtitle: 'foo' },
+    controller: 'users',
+    action: 'create'
+  }
+}
+```
+
+_**Note:** `params` will be filtered according to your `Rails.application.config.filter_parameters` configuration, making them (probably) safe for logging. But always double-check that you're not inadvertently logging sensitive form data, like passwords and credit cards._
+
+### Content Security Policy
+
+If you're using a Content Security Policy (CSP) in your Rails app, you will need to generate a nonce on the server, and pass `nonce: true` attribute to the view helper. Uncomment the following lines in your `config/initializers/content_security_policy.rb` file:
+
+```ruby
+# Be sure to restart your server when you modify this file.
+
+# If you are using UJS then enable automatic nonce generation
+Rails.application.config.content_security_policy_nonce_generator = -> request { SecureRandom.base64(16) }
+
+# Set the nonce only to specific directives
+Rails.application.config.content_security_policy_nonce_directives = %w(style-src)
+```
+Note that if you are already generating nonce for scripts, you'd have to include `script-src` to `content_security_policy_nonce_directives` as well:
+
+```ruby
+Rails.application.config.content_security_policy_nonce_directives = %w(script-src style-src)
+```
+
+And in your view helper, you need to pass `nonce: true` to the `invisible_captcha` helper:
+
+```erb
+<%= invisible_captcha nonce: true %>
+```
+
+**WARNING:** Content Security Policy can break your site! If you already run a website with third-party scripts, styles, images, and fonts, it is highly recommended to enable CSP in report-only mode and observe warnings as they appear. Learn more at MDN:
+
+* https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
+* https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
+
 ### I18n
 
 `invisible_captcha` tries to use I18n when it's available by default. The keys it looks for are the following:
@@ -154,10 +263,33 @@ en:
     timestamp_error_message: "Sorry, that was too quick! Please resubmit."
 ```
 
-You can override the english ones in your own i18n config files as well as add new ones for other locales.
+You can override the English ones in your i18n config files as well as add new ones for other locales.
 
 If you intend to use I18n with `invisible_captcha`, you _must not_ set `sentence_for_humans` or `timestamp_error_message` to strings in the setup phase.
 
+## Testing your controllers
+
+If you're encountering unexpected behaviour while testing controllers that use the `invisible_captcha` action filter, you may want to disable timestamp check for the test environment. Add the following snippet to the `config/initializers/invisible_captcha.rb` file:
+
+```ruby
+# Be sure to restart your server when you modify this file.
+
+InvisibleCaptcha.setup do |config|
+  config.timestamp_enabled = !Rails.env.test?
+end
+```
+
+Another option is to wait for the timestamp check to be valid:
+
+```ruby
+# Maybe in a before block
+InvisibleCaptcha.init!
+InvisibleCaptcha.timestamp_threshold = 1
+
+# Before testing your controller action
+sleep InvisibleCaptcha.timestamp_threshold
+```
+
 ## Contribute
 
 Any kind of idea, feedback or bug report are welcome! Open an [issue](https://github.com/markets/invisible_captcha/issues) or send a [pull request](https://github.com/markets/invisible_captcha/pulls).
@@ -179,6 +311,12 @@ $ bundle exec appraisal install
 $ bundle exec appraisal rspec
 ```
 
+Run specs against specific version:
+
+```
+$ bundle exec appraisal rails-6.0 rspec
+```
+
 ### Demo
 
 Start a sample Rails app ([source code](spec/dummy)) with `InvisibleCaptcha` integrated:

data/Rakefile

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "bundler/gem_tasks"
 require 'rspec/core/rake_task'
 

data/gemfiles/{rails_3.2.gemfile → rails_5.2.gemfile}

@@ -2,6 +2,6 @@
 
 source "https://rubygems.org"
 
-gem "rails", "~> 3.2.0"
+gem "rails", "~> 5.2.0"
 
-gemspec :path => "../"
+gemspec path: "../"

data/gemfiles/{rails_4.1.gemfile → rails_6.0.gemfile}

@@ -2,6 +2,6 @@
 
 source "https://rubygems.org"
 
-gem "rails", "~> 4.1.0"
+gem "rails", "~> 6.0.0"
 
-gemspec :path => "../"
+gemspec path: "../"

data/gemfiles/{rails_5.1.gemfile → rails_6.1.gemfile}

@@ -2,6 +2,6 @@
 
 source "https://rubygems.org"
 
-gem "rails", "~> 5.1.0"
+gem "rails", "~> 6.1.0"
 
-gemspec :path => "../"
+gemspec path: "../"

data/invisible_captcha.gemspec

@@ -5,8 +5,8 @@ Gem::Specification.new do |spec|
   spec.version       = InvisibleCaptcha::VERSION
   spec.authors       = ["Marc Anguera Insa"]
   spec.email         = ["srmarc.ai@gmail.com"]
-  spec.description   = "Unobtrusive, flexible and simple spam protection for Rails applications using honeypot strategy for better user experience."
-  spec.summary       = "Simple honeypot protection for RoR apps"
+  spec.description   = "Unobtrusive, flexible and complete spam protection for Rails applications using honeypot strategy for better user experience."
+  spec.summary       = "Honeypot spam protection for Rails"
   spec.homepage      = "https://github.com/markets/invisible_captcha"
   spec.license       = "MIT"
 
@@ -15,11 +15,8 @@ Gem::Specification.new do |spec|
   spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
   spec.require_paths = ["lib"]
 
-  spec.add_dependency 'rails', '>= 3.2.0'
+  spec.add_dependency 'rails', '>= 5.0'
 
-  spec.add_development_dependency 'rspec-rails', '~> 3.1'
+  spec.add_development_dependency 'rspec-rails'
   spec.add_development_dependency 'appraisal'
-  spec.add_development_dependency 'test-unit', '~> 3.0'
-  spec.add_development_dependency 'byebug'
 end
-