Google reCAPTCHA Implementation Inquiry v2 |Implementation dispute

Question

Hi Team,We would like to seek clarification regarding the implementation of reCAPTCHA v2.We implemented reCAPTCHA v2 a few years ago and would like to confirm whether server-side validation was mandatory at that time. Based on the documentation available then, it does not explicitly state that Step 3 (server-side verification) was mandatory. We are referring to the documentation linked below.reCAPTCHA v2  |  Google for DevelopersPlease note that this clarification is specifically for our old implementation carried out in 2020. Kindly provide your response considering the documentation and circumstances that were applicable during that period, rather than the current implementation guidelines.

faube · Answer

Hello,reCAPTCHA v2 and v3, as well as their equivalentsin the reCAPTCHA Enterprise API,all return tokens that your server must verify via a call tohttps://www.google.com/recaptcha/api/siteverifyorrecaptchaenterprise.googleapis.comAn attacker canbypass reCAPTCHA if you do not verify that they created a legitimate reCAPTCHA token on your site.More information about how reCAPTCHA works:https://docs.cloud.google.com/recaptcha/docs/overview#how-recaptcha-enterprise-works

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded