Self-hosted Docker image uses hardcoded captcha-site-key in frontend despite CAPTCHA_SITE_KEY environment variable

Product

Platform/Access controls/Other

Describe the bug

When running the self-hosted Infisical Docker image, configuring CAPTCHA_SITE_KEY at runtime does not configure the hCaptcha site key used by the frontend.

The Infisical container correctly receives the configured environment variable. For example:

CAPTCHA_SITE_KEY=<valid-hcaptcha-site-key>

However, the frontend continues to initialise hCaptcha using the literal placeholder value:

captcha-site-key

This causes hCaptcha to display:

ERROR for site owner: Invalid site key

Inspecting the network request from the browser confirms that the placeholder is being sent to hCaptcha:

https://api.hcaptcha.com/checksiteconfig?...&host=<infisical-host>&sitekey=captcha-site-key&...

Inspecting the running container confirms that the placeholder is embedded inside the compiled frontend JavaScript bundle:

/backend/frontend-build/assets/index-v0-165-6-BXoyH3V2.js:captcha-site-key

At the same time, inspecting the container environment confirms that the real site key is correctly configured:

CAPTCHA_SITE_KEY=<valid-hcaptcha-site-key>

It therefore appears that the frontend's hCaptcha site key is being injected at Docker image build time rather than being configurable at container runtime.

This prevents features requiring hCaptcha, such as password recovery, from working correctly with the standard self-hosted Docker image even when CAPTCHA_SITE_KEY and CAPTCHA_SECRET are correctly supplied to the container.

To Reproduce

1. Deploy the official self-hosted Infisical Docker image.

2. Configure valid hCaptcha credentials as environment variables on the Infisical container:

   复制

   CAPTCHA_SITE_KEY=<valid-hcaptcha-site-key>
   CAPTCHA_SECRET=<valid-hcaptcha-secret>
   

3. Confirm that the site key is present inside the running container:

   bash复制

   docker inspect infisical \
     --format '{{range .Config.Env}}{{println .}}{{end}}' \
     | grep -Ei 'CAPTCHA|HCAPTCHA'

   This correctly returns:

   复制

   CAPTCHA_SITE_KEY=<valid-hcaptcha-site-key>
   

4. Navigate to a feature which uses hCaptcha, such as the password recovery page.

5. The hCaptcha widget displays:

   复制

   ERROR for site owner:
   Invalid site key
   

6. Inspect the hCaptcha checksiteconfig request in the browser's developer tools.

   Despite the container having a valid CAPTCHA_SITE_KEY, the request contains:

   复制

   sitekey=captcha-site-key
   

7. Search the compiled frontend assets inside the running container:

   bash复制

   docker exec infisical sh -c \
     'grep -R -l "captcha-site-key" /backend/frontend-build 2>/dev/null | head'

   On v0.165.6 this returns:

   复制

   /backend/frontend-build/assets/index-v0-165-6-BXoyH3V2.js
   

8. Confirm the placeholder is embedded in the bundle:

   bash复制

   docker exec infisical sh -c \
     'grep -R -o "captcha-site-key" /backend/frontend-build 2>/dev/null | head'

   This returns:

   复制

   /backend/frontend-build/assets/index-v0-165-6-BXoyH3V2.js:captcha-site-key

The frontend therefore appears to be using a site key compiled into the Docker image rather than the CAPTCHA_SITE_KEY supplied to the running container.

Expected behavior

When CAPTCHA_SITE_KEY is supplied to the self-hosted Infisical container, the frontend should use that value when initialising hCaptcha.

For example, given:

CAPTCHA_SITE_KEY=<valid-hcaptcha-site-key>

the hCaptcha checksiteconfig request should contain:

sitekey=<valid-hcaptcha-site-key>

rather than:

sitekey=captcha-site-key

A self-hosted deployment should be able to configure both the hCaptcha site key and secret through runtime configuration/environment variables without requiring a custom build of the Infisical Docker image or modification of the compiled frontend assets.

If CAPTCHA_SITE_KEY is intentionally a build-time-only setting, this should at minimum be clearly documented for self-hosted deployments. However, runtime configuration would be preferable because users of the official pre-built Docker image cannot otherwise provide their own hCaptcha site key.

Screenshots

Deployment Type

Self-hosted

Additional context

Infisical version:

v0.165.6

Docker image:

infisical/infisical:v0.165.6

Deployment type:

Self-hosted using the official Infisical Docker image.

Host OS:

Linux (Ubuntu server)