reCAPTCHA v3/enterprise - Actions feature

[jamesmacwhite]

What are you trying to do?

reCAPTCHA v3/enterprise has more recently introduced an actions feature: https://developers.google.com/recaptcha/docs/v3#actions

This allows you to label different instances of where reCAPTCHA is being used and populates the following reports in the admin console.

I don't know if you'd consider there being any value of implementing this into Formie. The action label could either be generic as form_submit or plugin specific i.e. formie_form_submit or possibly the form handle as a more dynamic value.

It is recommended by implementing an action on the front-end that the backend validation is also checked to confirm it is expected.

What's your proposed solution?

Considering implementing an action on the front end JS and adding validation of the action value chosen on the back end for additional reporting/analytics in the reCAPTCHA v3 console.

It is an enhancement, rather than a critical feature, but just wanted to get thoughts on it generally. I'd consider doing a PR, but depends on if it is something you'd consider worthy or useful to Formie.

Additional context

No response

[engram-design]

I'd have to look into the specifics of it if it's adding back-end validation and not just adding the property to the front end, but all too happy to entertain.

[jamesmacwhite]

Based on the documentation. It states if you use an action value, it should be checked in the back-end, technically not a requirement, but I assume because it is something that is provided on the front-end JS, that to prevent manipulation of the action value.

The main benefit is reporting I think, you can see different usage of reCAPTCHA categorised by whatever action label assigned, in the case of Formie, it could be a general formie_submit value across all forms, or using the form handle to provide per form analytics, whether or not this would be a const value defined in the code or something configurable in the integration settings, up for consideration.

It is a V3/V3 enterprise only feature though, so needs to only be applied to V3 integrations only and not anything V2.

[engram-design]

I imagine you'd also want that configurable - maybe even per-form to track things?

[jamesmacwhite]

Per form would seem beneficial. There could be an instance for example of a certain form or perhaps multiple forms triggering more suspicious requests than others, which the actions feature would allow you to see in the dashboard.