I am doing a Java (JSP + Servlet) web application (I understand that this question is technology-independent). I hope to use the latest Google reCAPTCHA service. I am playing with a Google reCAPTCHA example found here: https://developers.google.com/recaptcha/docs/display#config <pre class="prettyprint"><code><html> <head> <title>reCAPTCHA demo: Simple page</title> <script src="https://www.google.com/recaptcha/api.js" async defer></script> </head> <body> <form action="?" method="POST"> <div class="g-recaptcha" data-sitekey="my_site_key"></div> <input type="submit" value="Submit"> </form> </body> </html> </code></pre> I am able to see the displayed recaptcha image as follows: <img src="https://i.stack.imgur.com/7CLJo.png" alt="enter image description here"> When I check "I'm not a robot", I get the following: <img src="https://i.stack.imgur.com/V53IO.png" alt="enter image description here"> As you can see, there is a Verify button and based on my tests, user response is sent to Google for verification. How can I get the user response so that I can verify user response in my own backend code (as suggested by Google at https://developers.google.com/recaptcha/docs/verify). <pre class="prettyprint"><code>g-recaptcha-response POST parameter when the user submits the form on your site </code></pre> On the server side, I can, by clicking on the "Submit" button, get user input from parameter "g-recaptcha-response" only when a user is verified successfully with Google first. Otherwise, "g-recaptcha-response" is blank on the server side. This means that I can do server-side verification only after the client-side's verification success. If so, what is the point of doing another verification on the server-side, which is the option provided by Google reCAPTHA? Do I miss anything?

The cool thing about the new Google Recaptcha is that the validation is now completely encapsulated in the widget. That means, that the widget will take care of asking questions, validating responses all the way till it determines that a user is actually a human, only then you get a g-recaptcha-response value. But that does not keep your site safe from HTTP client request forgery. Anyone with HTTP POST knowledge could put random data inside of the g-recaptcha-response form field, and foll your site to make it think that this field was provided by the google widget. So you have to validate this token. In human speech it would be like, <ul> <li> Your Server: Hey Google, there's a dude that tells me that he's not a robot. He says that you already verified that he's a human, and he told me to give you this token as a proof of that.</li> <li> Google: Hmm... let me check this token... yes I remember this dude I gave him this token... yeah he's made of flesh and bone let him through.</li> <li> Your Server: Hey Google, there's another dude that tells me that he's a human. He also gave me a token.</li> <li> Google: Hmm... it's the same token you gave me last time... I'm pretty sure this guy is trying to fool you. Tell him to get off your site.</li> </ul> Validating the response is really easy. Just make a GET Request to https://www.google.com/recaptcha/api/siteverify?secret=your_secret&response=response_string&remoteip=user_ip_address And replace the response_string with the value that you earlier got by the g-recaptcha-response field. You will get a JSON Response with a success field. More information here: https://developers.google.com/recaptcha/docs/verify Edit: It's actually a POST, as per documentation here.

Google reCAPTCHA: How to get user response and validate in the server side?

I am doing a Java (JSP + Servlet) web application (I understand that this question is technology-independent). I hope to use the latest Google reCAPTCHA service.

I am playing with a Google reCAPTCHA example found here:

https://developers.google.com/recaptcha/docs/display#config

<html>   <head>     <title>reCAPTCHA demo: Simple page</title>      <script src="https://www.google.com/recaptcha/api.js" async defer></script>   </head>   <body>     <form action="?" method="POST">       <div class="g-recaptcha" data-sitekey="my_site_key"></div>       <br/>       <input type="submit" value="Submit">     </form>   </body> </html>

I am able to see the displayed recaptcha image as follows:

enter image description here

When I check "I'm not a robot", I get the following:

enter image description here

As you can see, there is a Verify button and based on my tests, user response is sent to Google for verification.

How can I get the user response so that I can verify user response in my own backend code (as suggested by Google at https://developers.google.com/recaptcha/docs/verify).

g-recaptcha-response POST parameter when the user submits the form on your site

On the server side, I can, by clicking on the "Submit" button, get user input from parameter "g-recaptcha-response" only when a user is verified successfully with Google first. Otherwise, "g-recaptcha-response" is blank on the server side. This means that I can do server-side verification only after the client-side's verification success. If so, what is the point of doing another verification on the server-side, which is the option provided by Google reCAPTHA?

Do I miss anything?

How do you validate Google reCAPTCHA V2 on server side?

On the server side, I can, by clicking on the "Submit" button, get user input from parameter "g-recaptcha-response" only when a user is verified successfully with Google first.

How do I add reCAPTCHA validation?

2. In order to add CAPTCHA validation to your project it is necessary to install “NgxCaptchaModule” to the existing project. Therefore open your terminal and use this command npm i ngx-captcha .

The cool thing about the new Google Recaptcha is that the validation is now completely encapsulated in the widget. That means, that the widget will take care of asking questions, validating responses all the way till it determines that a user is actually a human, only then you get a g-recaptcha-response value.

But that does not keep your site safe from HTTP client request forgery.

Anyone with HTTP POST knowledge could put random data inside of the g-recaptcha-response form field, and foll your site to make it think that this field was provided by the google widget. So you have to validate this token.

In human speech it would be like,

Your Server: Hey Google, there's a dude that tells me that he's not a robot. He says that you already verified that he's a human, and he told me to give you this token as a proof of that.
Google: Hmm... let me check this token... yes I remember this dude I gave him this token... yeah he's made of flesh and bone let him through.
Your Server: Hey Google, there's another dude that tells me that he's a human. He also gave me a token.
Google: Hmm... it's the same token you gave me last time... I'm pretty sure this guy is trying to fool you. Tell him to get off your site.

Validating the response is really easy. Just make a GET Request to

https://www.google.com/recaptcha/api/siteverify?secret=your_secret&response=response_string&remoteip=user_ip_address

And replace the response_string with the value that you earlier got by the g-recaptcha-response field.

You will get a JSON Response with a success field.

More information here: https://developers.google.com/recaptcha/docs/verify

Edit: It's actually a POST, as per documentation here.

Google reCAPTCHA: How to get user response and validate in the server side?

Tags:

java

javascript

recaptcha

curious1

People also ask

1 Answers

TheRueger

Recent Activity

Donate For Us

Google reCAPTCHA: How to get user response and validate in the server side?

Tags:

java

javascript

recaptcha

curious1

People also ask

1 Answers

TheRueger

Related questions

Recent Activity

Donate For Us