CODEWITHSUNDEEP
recaptchaverificationrecaptcha-v3
HybrisHelp
HybrisHelp

Reputation: 5810

reCAPTCHA V3 : Do we need to verify token for each page?

Placement on your website
reCAPTCHA v3 will never interrupt your users, so you can run it whenever you like without affecting conversion. reCAPTCHA works best when it has the most context about interactions with your site, which comes from seeing both legitimate and abusive behavior. For this reason, we recommend including reCAPTCHA verification on forms or actions as well as in the background of pages for analytics.

Source: https://developers.google.com/recaptcha/docs/v3

The above document says we need to integrate ReCAPTCHA V3 on multiple pages. So question is, do we really need to generate and verify token for each page or just generating token is enough?

like

 grecaptcha.execute(reCaptchaPublicKey, {action: 'cartpage'}).then(function(token) {
            //skip verification
        });

Note: On the form for which I want to block the bot, I am generating a token and passing it to the server with the user's form data. Now on the server-side, I am validating token using API and getting a score in response to take further action. like, block the user action if the score is low.

Upvotes: 3

Views: 1102

Answers (1)

Oktokolo
Oktokolo

Reputation: 181

No, Calling grecaptcha.execute with the appropriate action (use 'homepage' for traffic on your homepage) is enough to make the reCAPTCHA service count and process the visit.
The token that is provided to your callback is requested from the reCAPTCHA service by the reCAPCHA client script. Sending it to your server to then send it back to the reCAPTCHA service to get the score makes no sense if you don't use the score.

Upvotes: 4

Related Questions