I am doing a Java (JSP + Servlet) web application (I understand that this question is technology-independent). I hope to use the latest Google reCAPTCHA service. I am playing with a Google reCAPTCHA example found here: https://developers.google.com/recaptcha/docs/display#config <pre class="prettyprint"><code><html> <head> <title>reCAPTCHA demo: Simple page</title> <script src="https://www.google.com/recaptcha/api.js" async defer></script> </head> <body> <form action="?" method="POST"> <div class="g-recaptcha" data-sitekey="my_site_key"></div> <input type="submit" value="Submit"> </form> </body> </html> </code></pre> I am able to see the displayed recaptcha image as follows: <img src="https://i.stack.imgur.com/7CLJo.png" alt="enter image description here"> When I check "I'm not a robot", I get the following: <img src="https://i.stack.imgur.com/V53IO.png" alt="enter image description here"> As you can see, there is a Verify button and based on my tests, user response is sent to Google for verification. How can I get the user response so that I can verify user response in my own backend code (as suggested by Google at https://developers.google.com/recaptcha/docs/verify). <pre class="prettyprint"><code>g-recaptcha-response POST parameter when the user submits the form on your site </code></pre> On the server side, I can, by clicking on the "Submit" button, get user input from parameter "g-recaptcha-response" only when a user is verified successfully with Google first. Otherwise, "g-recaptcha-response" is blank on the server side. This means that I can do server-side verification only after the client-side's verification success. If so, what is the point of doing another verification on the server-side, which is the option provided by Google reCAPTHA? Do I miss anything?

The cool thing about the new Google Recaptcha is that the validation is now completely encapsulated in the widget. That means, that the widget will take care of asking questions, validating responses all the way till it determines that a user is actually a human, only then you get a g-recaptcha-response value. But that does not keep your site safe from HTTP client request forgery. Anyone with HTTP POST knowledge could put random data inside of the g-recaptcha-response form field, and foll your site to make it think that this field was provided by the google widget. So you have to validate this token. In human speech it would be like, <ul> <li> Your Server: Hey Google, there's a dude that tells me that he's not a robot. He says that you already verified that he's a human, and he told me to give you this token as a proof of that.</li> <li> Google: Hmm... let me check this token... yes I remember this dude I gave him this token... yeah he's made of flesh and bone let him through.</li> <li> Your Server: Hey Google, there's another dude that tells me that he's a human. He also gave me a token.</li> <li> Google: Hmm... it's the same token you gave me last time... I'm pretty sure this guy is trying to fool you. Tell him to get off your site.</li> </ul> Validating the response is really easy. Just make a GET Request to https://www.google.com/recaptcha/api/siteverify?secret=your_secret&response=response_string&remoteip=user_ip_address And replace the response_string with the value that you earlier got by the g-recaptcha-response field. You will get a JSON Response with a success field. More information here: https://developers.google.com/recaptcha/docs/verify Edit: It's actually a POST, as per documentation here.

Google reCAPTCHA: How to get user response and validate in the server side?

Tags:

java

javascript

recaptcha

I am doing a Java (JSP + Servlet) web application (I understand that this question is technology-independent). I hope to use the latest Google reCAPTCHA service.

I am playing with a Google reCAPTCHA example found here:

https://developers.google.com/recaptcha/docs/display#config

<html>   <head>     <title>reCAPTCHA demo: Simple page</title>      <script src="https://www.google.com/recaptcha/api.js" async defer></script>   </head>   <body>     <form action="?" method="POST">       <div class="g-recaptcha" data-sitekey="my_site_key"></div>       <br/>       <input type="submit" value="Submit">     </form>   </body> </html>

I am able to see the displayed recaptcha image as follows:

enter image description here

When I check "I'm not a robot", I get the following:

enter image description here

As you can see, there is a Verify button and based on my tests, user response is sent to Google for verification.

How can I get the user response so that I can verify user response in my own backend code (as suggested by Google at https://developers.google.com/recaptcha/docs/verify).

g-recaptcha-response POST parameter when the user submits the form on your site

On the server side, I can, by clicking on the "Submit" button, get user input from parameter "g-recaptcha-response" only when a user is verified successfully with Google first. Otherwise, "g-recaptcha-response" is blank on the server side. This means that I can do server-side verification only after the client-side's verification success. If so, what is the point of doing another verification on the server-side, which is the option provided by Google reCAPTHA?

Do I miss anything?

597

asked Dec 04 '14 14:12

curious1

1 Answers

The cool thing about the new Google Recaptcha is that the validation is now completely encapsulated in the widget. That means, that the widget will take care of asking questions, validating responses all the way till it determines that a user is actually a human, only then you get a g-recaptcha-response value.

But that does not keep your site safe from HTTP client request forgery.

Anyone with HTTP POST knowledge could put random data inside of the g-recaptcha-response form field, and foll your site to make it think that this field was provided by the google widget. So you have to validate this token.

In human speech it would be like,

Your Server: Hey Google, there's a dude that tells me that he's not a robot. He says that you already verified that he's a human, and he told me to give you this token as a proof of that.
Google: Hmm... let me check this token... yes I remember this dude I gave him this token... yeah he's made of flesh and bone let him through.
Your Server: Hey Google, there's another dude that tells me that he's a human. He also gave me a token.
Google: Hmm... it's the same token you gave me last time... I'm pretty sure this guy is trying to fool you. Tell him to get off your site.

Validating the response is really easy. Just make a GET Request to

https://www.google.com/recaptcha/api/siteverify?secret=your_secret&response=response_string&remoteip=user_ip_address

And replace the response_string with the value that you earlier got by the g-recaptcha-response field.

You will get a JSON Response with a success field.

More information here: https://developers.google.com/recaptcha/docs/verify

Edit: It's actually a POST, as per documentation here.

102

answered Sep 30 '22 14:09

TheRueger

Related questions
                            
                                how do I make jfilechooser only accept .txt
                            
                                Resetting the time part of a timestamp in Java
                            
                                How to get the Context from anywhere? [duplicate]
                            
                                eclipse magic: ... Syntax error, varargs are only available if source level is 1.5 or greater
                            
                                Convert UTC to current locale time
                            
                                Calculating time difference in Milliseconds
                            
                                javax.validation to validate list of values?
                            
                                How to parse number string containing commas into an integer in java?
                            
                                How should I map string keys to values in Java in a memory-efficient way?
                            
                                Always show map marker title in Android
                            
                                BAT file to create Java CLASSPATH
                            
                                How to add a method to Enumeration in Scala?
                            
                                Get first day of a particular week in Joda-Time? java
                            
                                Spring Boot Controller not mapping
                            
                                String parsing in Java with delimiter tab "\t" using split
                            
                                How to change text color in the JTextArea?
                            
                                Android close dialog after 5 seconds?
                            
                                Calender.getInstance() gives error in Android Studio
                            
                                convert xml to java object using jaxb (unmarshal)
                            
                                Getting NoSuchMethodError: javax.servlet.ServletContext.addServlet in Spring Boot while running a Spring MVC application

Donate For Us

If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!

Donate Us With