使用Java2D的AlphaComposite实现，选用的Rule为alpha 1.0的SrcOut，即通过公式

Ar = As * (1 – Ad )
Cr = Cs * (1 – Ad )
用语言描述就是叠加区域的透明度为0. 使用这种机制必须采用BufferedImage.TYPE_INT_ARGB的图像，并且输出支持alpha通道的格式。

Changeset

• ApiKey database derby / h2 support, still use hsql as default because it’s fastest (#9)
• Captcha provider classes now loaded dynamically on runtime. They are not managed by guice container any longer. (#15)
• The useless cache module was completely removed (#10)
• ApiKey CRUD UI has been replaced by RESTful GET/PUT/DELETE interfaces
• For text-based captcha, just return the question in ticket, no need for (also impossible to)  retrieve it from browser (#8)
• Resource has been separated from the project file (#14 #18)
• Add test to make sure the /ticket and /validate request are sent by the same application (#17)
• Standardized error output: use HTTP error for client(browser), a selected error object for application (#24 #26)
• /captcha/ request (invoked by client directly) now accepts configuration parameters
• ApiKey is now binded to specified domain, it will check the /captcha request’s referer (#27)
• NEW captcha provider introduced in: Tiled Image Captcha (#12)
• JMX monitoring support on EhCache (#33)
• a great deal of code improvements and bug-fixes

Interface changes

The object return by /ticket has its attribute “url” renamed to “data”.

Screenshots

Use visualvm or jconsole the monitor ehcache status and statistics (enabled in 0.4 by default):

The new captcha provider in ruby and python sample application (Sample Code):

Download & Deploy

Since 0.4, yan package are available for download directly. Please refer to the  download page, grab both yan-0.4.war and yan-resource.tar.bz2. Just throw the war package to your servlet container.  Then extract the resource package to your disk. Don’t forget to set the environment variable:
export YAN_RESOURCE=/path/to/your/resource

Start the servlet container in the same context, browser http://localhost:8080/yan-0.4/ to see the test page and emulate the captcha process.

Retrieve the code

Clone the mercurial repository from bitbucket.org

$ hg clone https://sunng@bitbucket.org/sunng/yan/

You will get a copy of whole code repository (because mercurial is a distributed version control system). You are on the default branch at the beginning. The default branch maintains the code of 0.4, if you want to see latest things on Yan, switch to the development branch by

$ hg update 0.5-dev

Yan 0.5 is already on the way.

Reporting Issue

Issue reporting and patch submitting are always welcomed. Check the issue tracker on bitbucket, you will find new features in 0.5

Thanks for your support and !

今天新增的拼图验证码的可配置性非常强，你只要替换资源文件，在配置文件中修改提问的模版，指定图片的大小、行数、列数，就可以创造一套全新的验证码。他的简单程度实在超出你的想象。

提示文字： Please figure out twitter icons.

用户输入Twitter图标左上角上的字母，即可进行验证。在Yan的测试界面上使用如图：

Web2.0 Icon实际上是Yan中新增的拼图验证码的一个实例，利用拼图验证码可以生成相似的更有创意的验证码。在我的开发环境中生成这样一张图片大约需要80ms。

项目中使用的图标均从互联网收集，遵循CC等协议或经作者授权，详情参考项目中README文件。

祝DAF同学生日快乐。

• Intel Xeon 3.00GHz 4核
• 内存2G
• Red Hat Enterprise Linux AS release 4 (Nahant Update 7)
• Jetty 6 / JDK 6

Jetty采用默认配置 maxThreads 200。

测试工具：ab (Apache Bench)

分别用10/50/100/200/500/1000并发用户，每个用户请求100次进行测试。结果如下：



目前对每个请求独立使用JDK的awt实时绘图，吞吐量可以达到400以上，如果稍稍优化一下Jetty的配置，性能还有一定的提升空间。这个结果还是不错的。

Before we start to use the service, it is necesary to get Yan running. Download the code from the project page, then build and run it with maven:
mvn jetty:run

To enable the application to use Yan, we have to register our application to get an API Key. If you use Yan 0.3, there is a secret registration page at http://localhost:8080/yan/reg.jsp The page is protected by HTTP Basic Authentication, the username and password are store in ‘realm.properties’ which is considered to locate in the root directory. Open the file you can see the plain text username and password. If you are running the latest development version, there is no long any UI for API Key creation, but restful interface. This won’t be hard to you, pickup your tools such as curl or poster (a firefox extension) to send a HTTP request. Take curl as example, do it like this:
curl -X PUT “http://localhost:8080/yan/apikey/” -d “SinatraTestApp” -u “username:password”

If it works, you will get a line of json:
{“apikey”:”b251b0dc2eed31cac38555b61d4fa6a453923bfd”,”appName”:”SinatraTestApp”}
Save this apikey.

Sinatra is generally considered to be the world’s lightest and smallest web framework. And our application is rather simple. Just check the code:

require "rubygems"
require "sinatra"
require "net/http"
require "yaml"

apikey='b251b0dc2eed31cac38555b61d4fa6a453923bfd'

get '/' do
	conn = Net::HTTP.new('localhost', 8080)
	q = "ip=#{@env['REMOTE_ADDR']}&apikey=#{apikey}&alt=yaml&mode=0"
	resp, data = conn.get("/yan/ticket?#{q}")
	@ticket = YAML::load(data)
	haml :sinatra_captcha
end

post '/' do
	conn = Net::HTTP.new('localhost', 8080)
	q = "ip=#{@env['REMOTE_ADDR']}&apikey=#{apikey}&key=#{params['key']}&code=#{params['captcha']}"
	resp, data = conn.get("/yan/validate?#{q}")
	data
end

use_in_file_templates!
__END__

@@ sinatra_captcha
%html
	%head
		%title Yan Captcha on Sinatra
	%body
		%form{:action=>"/", :method=>"post"}
			%p
				Username:
				%input{:name=>"username", :type=>"text"}
			%p
				Password:
				%input{:name=>"password", :type=>"password"}
			%p
				Captcha:
				%img{:src=>@ticket['url']}
				%br
				%input{:name=>"captcha", :type=>"text"}
				%input{:name=>"key", :type=>"hidden", :value=>@ticket['key']}
				%input{:type=>'submit'}

There are two parts of this application: ruby code and haml. I just use in-file-template for convenience. We define a get handler and a post handler on the path ‘/’. The get handler will request a ticket from Yan which contains captcha image url and ticket key. The post handler will extract user input and submit the Yan’s validator and return user the result. And the HAML code is template for page rendering after GET request.

Maybe you need to install sinatra and some dependency:
sudo gem install sinatra haml

Run the code with a build-in WEBrick
ruby sinatra-yan.rb

Browse to the default url, test it:

For another similar tutorial using python, check Yan’s wiki page:
http://bitbucket.org/sunng/yan/wiki/SampleCode

Thank you for your support. btw, today is my dear girl friend’s birthday, I just wish her happy everyday.

This release has been focusing on support for different types captcha generators. Now Yan is not only able to provide image/jpeg captcha, but also text/plain and any others.

Changeset:

• Internal API Changes:
  • Cache API improved: new CacheItemIdentity and CacheIdStrategy were introduced in to provide convertion between cache item name and captcha info model;
  • Captcha Generator API improved: Add CaptchaGeneratorInfo to define some meta information on captcha providers (such as mode code, captcha type);
  • Captcha Data Model(CaptchaInfo) and Ticket Data Model improved: configuration parameters are separated from required parameters and has been more generic for different types of generator algorisms;
• External API Changes:
  • Rename /image url to /captcha for better literal accuracy;
  • /ticket now supports multiple types of applicable format (plain text / json / xml / yaml);
  • /ticket now returns the mime type of the captcha generator;
  • Add a Simple-Plain-Text generator as a sample for those whose mime type is other than image/jpeg;
• Other changes:
  • I created a new branch for next version of Yan. So the code in repository now has multiply branches, you can use ‘hg update branch-name’ to switch between difference branches;
  • The sample test page for the service (index.jsp) has been adopt to the new protocol and totally restyled.

Again, grab code from the development repository:
hg clone https://sunng@bitbucket.org/sunng/yan/

If you don’t use mercurial/hg, you can also download the tagged version from the page:
http://bitbucket.org/sunng/yan/downloads/

Just use maven to resolve dependency, build and run the project:
mvn jetty:run

Feel free to report issue

As you may know, the open-source project is split from my current work-time project because it is more closed to my idea. However, soon we will have the product opened to our thousands (millions ?) of users. I can gain feedback from the challenge and improve the open-source edition.

The code is maintained by open-source scm, mercurial (also known as hg). The project is now hosted on bitbucket.org. You can clone the code to local via:
$ hg clone https://sunng@bitbucket.org/sunng/yan/

To build the project, run this command in root of project directory:
mvn install

To run in a develop environment:
mvn jetty:run

Issue reporting and patches are always welcomed.

Check the wiki pages for more information about the project:
http://bitbucket.org/sunng/yan/wiki/Home