magento / security-package

Magento Security Extensions
Open Software License 3.0
66 stars 69 forks source link

The Magento works with Google reCaptcha v3 incorrectly. #329

Closed andrewbess closed 1 year ago

andrewbess commented 1 year ago

Preconditions (*)

  1. Magento 2.4.5-p1, Magento 2.4.6 (We didn't test it in other versions)
  2. Setup Google reCaptcha v3 in store configuration

Steps to reproduce (*)

  1. Setup Minimum Score Threshold to "1.0"
  2. Setup enabling reCaptcha for necessary forms in "Storefront" tab
  3. Try to submit form on storefront

Expected result (*)

  1. Google reCaptcha shows popup with reCaptcha challenge recaptcha-expected-resilt

Actual result (*)

  1. The system doesn't show popup with Google reCaptcha challenge recaptcha-actual-result
m2-assistant[bot] commented 1 year ago

Hi @andrewbess. Thank you for your report. To speed up processing of this issue, make sure that you provided sufficient information. Add a comment to assign the issue: @magento I am working on this


Join Magento Community Engineering Slack and ask your questions in #github channel.

fredden commented 1 year ago

@andrewbess as far as I know, Google reCAPTCHA v3 does not provide any opportunity for a human to prove they are not a robot. v3 provides a score to the application, which Magento transforms into a boolean. See https://github.com/magento/merchdocs/pull/1597 / https://github.com/magento/security-package/issues/319

It sounds like you want to use v2 so that a (client-side) challenge is presented to users with a low score. The extensions in this repository are working as designed.

andrewbess commented 1 year ago

@andrewbess as far as I know, Google reCAPTCHA v3 does not provide any opportunity for a human to prove they are not a robot. v3 provides a score to the application, which Magento transforms into a boolean. See magento/merchdocs#1597 / #319

It sounds like you want to use v2 so that a (client-side) challenge is presented to users with a low score. The extensions in this repository are working as designed.

Thank you @fredden for your answer.