Any examples of handling a recaptcha POST response? - perl

Question

Current version V2 reCaptcha returns a "POST" in CGI:params. Not exactly what the old V2 version did.
The up side is that any HTML form contents and the reCaptcha response come in at the same time. The down side is that the "g-recaptcha-response" value is a blob that requires local validation.
The "g-recaptcha-response" value looks something like this:
03AJzQf7OU1j33-wm7I73BItJg-l2COD-YwSjesvfej_5vy5c0r_LUhaDU1KsvU0BV0Rc-MHRbR4L17TNya1CqFtCJGulzvwTpKCfjwWcwqj2e3nFiqeropkXnYzwE78Eydr0jGi3OjZCKK71rmhOXZr0OA_nC8Cpd6aPaexqkrfLXdiXFPE7pQqc-qixYzVklb2MIuPyxw414kVbyHsbDr5p-pitK9cXvvPYK1Td7T_z6xnMUIuNN5zY3ArYzlAGexsSffucQRrzSKT_779In1QzwQppASux3-Z_xPLQgCLnRsJlwcby7gFFWXHSfAxV2ErpsiGWQcGa1
How can one decipher this response in Perl to be sure it is a genuine acknowledgement that the Turing test was solved correctly?

Answer 1

Do you know the module Captcha::reCAPTCHA::V2? I have succesfully used it and it is a great time saver. In plain CGI, the server side code that does the validation would look like:
my $rc = Captcha::reCAPTCHA::V2->new;
my $result = $rc->verify('<your secret key here>', param('g-recaptcha-response'), remote_host);
# Check the result
if( !$result->{success} ){
# The check failed, ignore the POST
next;
}
I assume that you have already created your reCAPTCHA keys, have your HTML form and an idea of how to create the rest of the server side code.
To help other people that may seek how to do this, this is a minimum form for the client side (this is based on bootstrap):
<form id="contact-form" method="post" action="contact">
<div class="row">
<div class="col-md-12">
<div class="form-group">
<label for="message">Comments</label>
<textarea id="message" type="text" name="message" class="form-control" placeholder="Your comments..." rows="4" required></textarea>
</div>
</div>
</div>
<div class="row">
<div class="col-md-12">
<div align="center">
<button
class="g-recaptcha"
data-sitekey="<your site key here>"
data-callback="onSubmit">
Enviar mensaje
</button>
</div>
</div>
</div>
</form>
<script>
function onSubmit(token) {
document.getElementById("contact-form").submit();
}
</script>
Then, on the server side you would need something like (this is based on FastCGI; for CGI you would not use the loop):
use CGI::Fast qw(:standard);
use Captcha::reCAPTCHA::V2;
...
while(my $query = new CGI::Fast) {
...
if( request_method eq 'POST' ) {
my $rc = Captcha::reCAPTCHA::V2->new;
my $result = $rc->verify('<your secret key here>', param('g-recaptcha-response'), remote_host);
# Check the result
if( !$result->{success} ){
# The check failed, ignore the POST
next;
}
# Do something with the form
}
...
}