views:

219

answers:

1

Hello all,

Here is a tutorial that indicates how to combine jQuery Form Validation with reCAPTCHA. http://snipplr.com/view/15563/jquery-validating-recaptcha-with-ajax/

Based on my understanding, the above tutorial in fact does a client side validation through aJax that communicates with the server reCAPTCHA script.

After the validation is successful, I use the following code borrowed from the comments:

$('#formID').validate({ 
submitHandler: function(form) { 
 if(validateCaptcha()){ // Submit form 
offerForm.ajaxSubmit(); } } });

to submit the form and please see line 21 of the original code:

$("form").attr("action", "http://action/to/the/form_handler.php");

My question is whether or not I MUST call recaptcha_check_answer inside form_handler.php with passed in parameters

challengeField = $("input#recaptcha_challenge_field").val();
responseField = $("input#recaptcha_response_field").val();

If not, then a person can easily avoid the reCAPTCHA by changing the validation procedure. It seems that the same idea that we always have to both client+server validation.

Please correct my idea if I misunderstand.

// Give detail information for the issue I have ///

    <code>
    <form id="regFormBody" method="post" action="verify.php">
    ...
    </code>

      $("#regFormBody").validate({
          debug: true,
          errorPlacement: function (error, element) {
            error.insertAfter(element.parents('div.collection:first'));
          },

          rules: {
            loginemail: { required: true, email: true, rangelength: [4, 32] },
            password: { required: true, rangelength: [8, 30], passwordPattern: true },
            confirmpassword: { required: true, rangelength: [8, 30], equalTo: "#password" }
          }
          }
        });

Here is the problem I have: If the form passes the client side validation, then it doesn't NOT trigger the verify.php at all and stops after the validation. thank you

+2  A: 

Yes, that sounds correct to me. Yes, you definitely need to validate the captcha on the server. I don't like the idea of validating the captcha client-side at all and I don't think you want to be posting your reCaptchi API keys in a script that user can get hold of either. Also I'd expect the second validation of the same captcha values (your server-side check after the client-side checke) would get rejected by recaptcha's servers anyway (confirmation of this from a comment on the original blog).

So I think you need to post the captcha to your AJAX action handler and it should do the validation as well as your action. You could validate the user has entered something for the captcha before you submit it but IMO you shouldn't try and validate it client side at all.

Rup
If you validate client side the attacker can fake it.
Matt Williamson
Hello Rup,I agree with you and also I will get a problem as you mentioned:"get rejected by recaptcha's servers anyway".Now the question is then how I can combine my jQuery Form Validation with recaptcha? In other words, when the user clicks the submit button, first I make sure that all other fields are correct. Then I need to validate the recaptcha and then do the form action.I really have no idea here how I can achieve two things at one time.thank you
q0987
I don't think there's anything to combine? You just let jQuery validate all your fields as usual then include the recaptcha in the post. Your post handler should validate the captcha and then return an error if the catpcha is wrong the same as you'd return any other error from your post handler. I guess you'd need to refresh the captcha control if there was an error, but then I expect you'll need to refresh the captcha control either way for the user's next ajax operation. Is that not what you're doing? What problems are you having?
Rup
Hello Rup,Thank you for your quick response. Please see my update post to give you some detail ideas what my current problem is.Thank you
q0987
That just looks like an error with jQuery validation now. I haven't used that syntax (specifying the rules in the validate call) myself before. It looks like you have one too many closing braces after rules but beyond that I don't think I can help sorry.
Rup