Need UI to wait to show confirmation until server has responded. about ng-recaptcha

[DethAriel]

Hi, thanks for posting this!

Unfortunately, this is not under component's control (or yours, that being said). The checkbox only shows that Google reCAPTCHA thinks whomever resolved this is not a robot. Yet, you still have to perform a server-side check of the reCAPTCHA response to verify the captcha integrity.

Recaptcha API does not support modifying this behavior. You can find original recaptcha docs here.

[tsanborn19-zz]

So what's the best way to handle having to wait for the server to send back a response? Seems weird that we would have to disable submit button until we get a response back.

[DethAriel]

It's supposed that you submit the captcha response along with the values, e.g. for a login form the payload would be:

{
  "username": "...",
  "password": "...",
  "captcha": "..."
}

Otherwise if your endpoint /XXX only supports { username, password } input - captcha is not really doing anything (since one could simply submit to /XXX directly without having to solve the captcha).

Bottomline: captcha response should be submitted along with the values it is protecting

[tsanborn19-zz]

Ah okay. Thanks for the response. We are only using client-side validation, which is why this is an issue for us. Appreciate the help though.

[DethAriel]

This reCAPTCHA usage is concerning at the very least - as the docs state

The secret authorizes communication between your application backend and the reCAPTCHA server to verify the user's response. The secret needs to be kept safe for security purposes.

(emphasis added by me). So it's two options here - either you're not using "secret" key or you store it on the client-side. In first scenario you might as well omit the captcha altogether - your "good" users are only suffering from it, while the bad guys would just bypass it. The second scenario is pretty much the same.

I would strongly encourage you to investigate further into this matter