Cannot validate recaptcha in cloud app behind Azure app gateway

[MikeRixWolfe]

I am currently unable to use the recaptcha library on an app I have running on azure behind an application gateway. The direct url would be myapp.azurewebsites.net however via the gateway the url is myapp.region.cloudapp.azure.com for the request, which is throwing the following:

System.ComponentModel.DataAnnotations.ValidationException: Recaptcha host, and request host do not match. Forgery attempt? at reCAPTCHA.AspNetCore.RecaptchaService.Validate(HttpRequest request, Boolean antiForgery) at reCAPTCHA.AspNetCore.Attributes.ValidateRecaptchaFilter.OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next) at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeNextActionFilterAsync>g__Awaited|10_0(ControllerActionInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted) at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Rethrow(ActionExecutedContextSealed context) at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted) at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeInnerFilterAsync>g__Awaited|13_0(ControllerActionInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted) at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeNextResourceFilter>g__Awaited|24_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted) at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Rethrow(ResourceExecutedContextSealed context) at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted) at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeFilterPipelineAsync>g__Awaited|19_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted) at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeAsync>g__Logged|17_1(ResourceInvoker invoker) at Microsoft.AspNetCore.Routing.EndpointMiddleware.<Invoke>g__AwaitRequestTask|6_0(Endpoint endpoint, Task requestTask, ILogger logger) at Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context) at IdentityServer4.Hosting.IdentityServerMiddleware.Invoke(HttpContext context, IEndpointRouter router, IUserSession session, IEventService events, IBackChannelLogoutService backChannelLogoutService) at IdentityServer4.Hosting.MutualTlsEndpointMiddleware.Invoke(HttpContext context, IAuthenticationSchemeProvider schemes) at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context) at IdentityServer4.Hosting.BaseUrlMiddleware.Invoke(HttpContext context) at Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore.MigrationsEndPointMiddleware.Invoke(HttpContext context) at Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore.DatabaseErrorPageMiddleware.Invoke(HttpContext httpContext) at Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore.DatabaseErrorPageMiddleware.Invoke(HttpContext httpContext) at Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.Invoke(HttpContext context)

In the markdown of my view I am adding the recaptcha like so: @(Html.Recaptcha<RecaptchaV2Checkbox>(RecaptchaSettings.Value, new RecaptchaV2Checkbox { SuccessCallback = "enableSubmit", ExpiredCallback = "disableSubmit" })) and in my controller I added the validation annotation: [ValidateRecaptcha(score: 0.7)].

How do I disable antiforgery validation on the recaptcha? Is there an undocumented way for dealing with forwarding domains?

[luisescobarsv]

Hi @MikeRixWolfe I have the same issue, how do you solve it?

[MikeRixWolfe]

I added the final external url to the app service under the custom domains section, which required pointing the domain at the app service via the CNAME record and setting the TXT record to validate the domain, then after the domain was added as a custom domain I updated the CNAME record to point at the gateway url. After that, everything worked when accessing the site thru the custom url.