CODEWITHSUNDEEP
ruby-on-rails-3recaptcha
JosephK
JosephK

Reputation: 678

Recaptcha ambethia - Input error: k: Format of site key was invalid / invalid-request-cookie

The error in the title is visible only in firebug. Everything from where I put the recaptcha element on down, is not shown on the page, though is present in the page-source (Mozilla and Opera) - though no error is shown in firebug.

So far, based on others solutions, I have tried reversing the keys (public and private, though they are clearly identified), generating a global-key-pair and using those, and even hard-coding the values into the recaptcha.rb initializer file versus using system-vars. No luck in any cases in dev or production. Also tried suppressing the 'noscript' part, with no change.

The Gem-Generated Page Source reads:

    <script type="text/javascript" src="//www.google.com/recaptcha/api/challenge?k=[" mypublickeyhere", "myprivatekeyhere", false]&amp;lang="></script>
    <noscript>
      <iframe src="//www.google.com/recaptcha/api/noscript?k=["mypublickeyhere", "myprivatekeyhere", false]" height="300" width="500" style="border:none;"></iframe><br/>
      <textarea name="recaptcha_challenge_field" rows="3" cols="40"></textarea>
      <input type="hidden" name="recaptcha_response_field" value="manual_challenge"/></noscript>

Why is my private key visible in the page-source? All that code comes from putting this in my view: 

    <%= recaptcha_tags %>

Edit: Made some progress, many hours in, by force-feeding the keys in the form and controller with:

    <%= recaptcha_tags :public_key => 'mypublickeyhere' %>

and

    if ( verify_recaptcha :private_key => 'myprivatekeyhere' )

Which gets the recaptcha to show up on the form, and keeps my private-key from being spammed to the page-code by the plugin as it does in 'default' mode.

Unfortunately, even if captcha is entered correctly, we get a NEW Error, "invalid-request-cookie".

Is there a single example of using this plugin in Rails 3, with full working form and controller code?

More Info for other sufferers:

Google Says this error means: "The challenge parameter of the verify script was incorrect."

On another page, if you search for "challenge parameter," to find out whatever that is, Google says: "recaptcha_challenge_field is a hidden field that describes the CAPTCHA which the user is solving. It corresponds to the 'challenge' parameter required by the reCAPTCHA verification API."

So why is the plugin not providing the correct challenge parameter as it should? Perhaps I need to pass something somewhere - but what and where? Again, a simple example would be great.

Upvotes: 1

Views: 5178

Answers (1)

JosephK
JosephK

Reputation: 678

0.0. Setting the Variables - an aside:

Use ENV['key'] to keep your keys out of the codebase (though you can hardcode them in /config/environments/development.rb and then not include this file on your production server (for Heroku, add to gitignore in your push folder).

I added this to my development.rb file

  # Set variables for Recaptcha on Localhost
    ENV['RECAPTCHA_PUBLIC_KEY'] =  'mypublickeyhere'
    ENV['RECAPTCHA_PRIVATE_KEY'] = 'myprivatekeyhere'

You will put your real key values in place of mybpublickeyhere and myprivatekeyhere.

You could also set ENV variables on your dev-machine. I prefer not to add that clutter, as this machine is used to develop many sites at once.

If deploying to Heroku, learn how to set these ENV variables here: http://devcenter.heroku.com/articles/config-vars

1.0 Get a set of global-keys, not tied to any particular domain, and use these for testing. After eliminating that potential problem, when all is working, put in your domain-specific keys, on your production machine, and re-test.

2.0 Don't use the 'default' method. From what I can tell, it simply does not work - maybe it once did and Google changed something - I don't know, but it may/will give you the dreaded "Input error: k: Format of site key was invalid" AND will reveal your private key to anyone who views the page-source.

The solution is to force-feed the keys into the form and controller. So, in your form this will look like:

    <%= recaptcha_tags :public_key => ENV['RECAPTCHA_PUBLIC_KEY'] %>

3.0 In your controller you will test for true; but again, force-feed the private key like this:

    if ( verify_recaptcha :private_key => ENV['RECAPTCHA_PRIVATE_KEY'] ) 
    ... your success code here
    else
    ... your fail code here
    end

4.0 Placement of the tag in the form is important. The Devise docs refer to this gem, and provide actual example code of using this gem: http://github.com/plataformatec/devise/wiki/How-To:-Use-Recaptcha-with-Devise They say to put the recaptcha_tags immediately above the submit button code. This is important. I had to put it within:

    <div class="form-actions">

... along with the button

Other sources report that surrounding HTML can break things in mysterious ways, so you may have to experiment for awhile (hope you don't have deadlines, or anything). These 'placement' issues were the culprit with the 'invalid-request-cookie' error I received.

I hope these guidelines shorten your development time.

Upvotes: 2

Related Questions