search

GoogleCloudPlatform / recaptcha-enterprise-mobile-sdk

Apache License 2.0
31 stars 6 forks source link

reCAPTCHA Enterprise does not respect global URLs #63

Closed thetanz-geoff closed 1 year ago

thetanz-geoff commented 1 year ago

Describe the bug

The reCAPTCHA Enterprise Mobile SDK doesn't support "global" usage. reCAPTCHA operations fail within mainland China.

reCAPTCHA Site Key

n/a

Integration Method

Affects both Android and iOS integrations.

SDK Version (e.g. 18.0.1): 18.1.1

To Reproduce

  1. Attempt a reCAPTCHA Enterprise operation from within mainland China.
  2. Note that the operation fails.

Expected behavior

  1. reCAPTCHA Enterprise should either always use the global URL promoted by Google (recaptcha.net - see link below), OR
  2. reCAPTCHA Enterprise should poll or geolocate to determine that it is running from within a restricted market, and attempt the global URL instead of the standard URL.

Screenshots

n/a

Xcode version for iOS (please complete the following information):

Device (please complete the following information):

Additional context

Famously, China's Great Firewall blocks access to most Google services from mainland China. This includes reCAPTCHA, and for the non-Enterprise web experience there are recommendations in the official documentation on using the correct URLs accessible from within China: https://developers.google.com/recaptcha/docs/faq#can-i-use-recaptcha-globally ...which also happen to work great for reCAPTCHA Enterprise.

Common packages which wrap reCAPTCHA for web frameworks also provide support for this: https://github.com/DethAriel/ng-recaptcha#loading-from-a-different-location

However, the reCAPTCHA Enterprise Mobile SDK appears to always use the non-global URLs, and not provide an option to configure this behaviour. This means that reCAPTCHA operations fail within mainland China unless a VPN or similar technology is used, which is not encouraged or a valid option to support our public mobile app users.

It looks like this may actually be the underlying cause of issue #60, judging by the comments. However, I feel it is worth explicitly documenting this missing feature. At the moment, we have had to resort to blocking our mobile app from use in China.

mcorner commented 1 year ago

Thanks for the report. This is indeed a duplicate of #60 We are aware of the issue (it isn't quite like you described, it is a bit more complicated). We have fixed it, but are still testing to verify.