2

I'm trying to create a CAPTHCA for my forms on a website, but it always gives back "invalid-input-response".

I have the following front code for my form with captcha:

<script src="https://www.google.com/recaptcha/enterprise.js" async defer></script>
<script>
    var onloadCallback = function() {
        grecaptcha.enterprise.render('html_element', {
            'sitekey' : '<?php echo G_RECAPTCHA_SITE_KEY?>',
            'callback' : function(response) {
                            if(response){
                                // success
                            }
                        },
            'theme' : 'dark'
        });
    };
</script>
<form>

...

<div id="html_element"></div>
</form>

<script src="https://www.google.com/recaptcha/enterprise.js?onload=onloadCallback&render=explicit" async defer></script>

End the backend side:

if(isset($_POST['g-recaptcha-response'])){
    $captcha=$_POST['g-recaptcha-response'];
}
if(!$captcha){
    // error
    return false;
}
$secretKey = G_RECAPTCHA_SECRET_KEY;
// post request to server
$url = 'https://www.google.com/recaptcha/api/siteverify'
        . '?secret=' . urlencode($secretKey) 
        . '&response=' . urlencode($captcha);
$response = file_get_contents($url);
$responseKeys = json_decode($response,true);
// should return JSON with success as true
if(!$responseKeys["success"]) {
    var_dump($responseKeys);
}

and the output is:

array(2) { ["success"]=> bool(false) ["error-codes"]=> array(1) { [0]=> string(22) "invalid-input-response" } }

G_RECAPTCHA_SITE_KEY and G_RECAPTCHA_SECRET_KEY are defined correctly, i checked them several times.

Do you have any suggestions? Is there something wrong with the code, or is it maybe something wrong with how i set up my reCAPTCHA Enterprise account?

Thanks in advance!

3
  • 2
    If you want to use reCAPTCHA Enterprise, then I think you are embedding the wrong script on the client side to begin with. You embedded https://www.google.com/recaptcha/api.js, but it should be https://www.google.com/recaptcha/enterprise.js, according to cloud.google.com/recaptcha-enterprise/docs/instrument-web-pages
    – CBroe
    Commented Sep 7, 2022 at 9:31
  • I've changed it to enterprise (i also edited the post) but the response is still the same.
    – Gergő S
    Commented Sep 7, 2022 at 9:47
  • 1
    The URL for the server-side request to verify the token, is also different with Enterprise. You really need to read the whole documentation.
    – CBroe
    Commented Sep 7, 2022 at 10:13

0

Browse other questions tagged or ask your own question.