Environment
- @google-cloud/recaptcha-enterprise-react-native 18.9.2
- Native SDK: iOS RecaptchaEnterprise 18.9.1
- React Native 0.81.1, iOS and Android
Usage
- On each login attempt the app calls Recaptcha.fetchClient(siteKey) and then client.execute(RecaptchaAction.LOGIN()) to request a token from the SDK.
- The app forwards the returned token to our backend. The backend creates an assessment and rejects tokens older than 5 minutes (RECAPTCHA_CHALLENGE_LOAD_EXPIRED). We also see INVALID_RECAPTCHA_RESPONSE.
Problem
In Google's assessment logs, several different tokens received by the app have the same createTime, even though they were requested at different times. Our backend then treats them as expired.
What we verified
- The app doesn't create, cache, or reuse tokens. It requests a new token from the SDK on every attempt and forwards it as received. It sets and sends no timestamp on the login call.
- The time at which the SDK returned each token to the app (UTC) differs per attempt, but Google's createTime repeats.
- The behavior is intermittent on the same device with identical code: it works at times and fails at others, and doesn't follow app install time.
Questions:
Why do different tokens returned by execute carry the same createTime in the assessment, and is there a supported way to force a fresh challenge on each execute?
