excelwebzone / EWZRecaptchaBundle

This bundle provides easy reCAPTCHA form field for Symfony.
MIT License
396 stars 160 forks source link

Execute the V3 Challenge on form submit, not on page load #286

Closed damienalexandre closed 2 years ago

damienalexandre commented 2 years ago

The V3 challenge is often wrong, because you have to submit your form in less than 2 minutes (before the challenge expire). That's because the challenge is asked too soon.

As per the documentation:

https://developers.google.com/recaptcha/docs/v3

reCAPTCHA tokens expire after two minutes. If you're protecting an action with reCAPTCHA, make sure to call execute when the user takes the action rather than on page load.

So I changed the JavaScript a bit to call execute on form submit, not on page load.

Also added this:

grecaptchaInput.value = ''; // Always reset the value to get a brand new challenge

Because the FormType is keeping the old challenge when the form is submitted with error, and ReCaptcha is not populating a fresh token if there is already one in the field.