search

UndefinedOffset / silverstripe-nocaptcha

A spam protector and form field using Google's reCAPTCHA v2 or optionally a foundation v3 implementation
BSD 3-Clause "New" or "Revised" License
31 stars 37 forks source link

NEW add support for recaptcha v3 #62

Closed wilr closed 4 years ago

UndefinedOffset commented 4 years ago

I believe this requires more work than just adding a different javascript implementation at the very least the score isn't being checked. I think my general stance on this is in #57. It's very much a per-site basis configuration it's not as simple as v2.

Not at the moment, the main reason being that the v3 recaptcha requires allot of per-site actions and a decision by the developer whether a score is good enough or not, it's much more per-site context than just putting a captcha into a form.

Have a look at @chillu's comment here for more context. He does his usual great summing up of the issues and I fully agree with his rational. As he mentions "the v3 API just allows you to send "actions" such as "submitting contact form", and you get back a score. If that score indicates a bot, it's up to site devs to make the next step: There is no built-in explicit verification. Since this module doesn't know anything about the site context, e.g. to trigger a login or MFA, or is designed to record other user actions (separate from form submissions).". The same would apply here unfortunately.

If there was a smart way this could be implemented in a good strong cross site way I'd be all for this but I'm not really sure there is unfortunately it seems to be so site specific.

wilr commented 4 years ago

@UndefinedOffset understood. We went with just the minimum_score option and if anything sits below that it's blocked. Pretty rudimental but fills the basic use of case. If you would prefer not to merge this are you happy for me to re-release your code under a new name with support for v3

UndefinedOffset commented 4 years ago

Ah see when I looked at this (before my morning coffee) I missed where you actually check the score lol. I think it looks good having a second look so I'm happy to merge. I just wonder if it maybe important to point out in the readme that for better results they maybe should follow more of them implementation docs to hone the result? Tbh I have t looked far into v3 since it's early days so maybe this is enough to get things going with a reasonable good result rate?

UndefinedOffset commented 4 years ago

I'm also wondering if we should have the min score not only in the config later but also overridable on a per instance basis? Perhaps I have one form with a higher bar than say a newsletter sign up form like a contact form.

wilr commented 4 years ago

@UndefinedOffset good idea 👍 I've added that in now setMinimumScore() and updated the documentation to make it clear how to tailor it.

I haven't added any API's for the new v3 actions - probably easy enough for a developer to handle on a case by case basis.

UndefinedOffset commented 4 years ago

Thanks! tagged as 2.1.0