reCaptcha v2: ASP.NET and Firewall

[Stephen Yip]

Dear all,

I have 2 questions in Google ReCaptcha v2:

1. Is there any sample for integration with ASP.Net Web Form (v4.5 or above)? I have a ASP.Net form which submits data to server but want to add ReCaptcha for security purpose.

2. My firewall is configured to handle in and out traffic. If ReCaptcha is used, is the traffic goes in which way:

     a.) Client communicates with google and the result is returned to my web server (which I think no re-configuration of firewall is required as there is no communication between my web server and google.com); or

     b.) Client communicates with my web server which post the captcha input to google.com, and the result is returned from google.com to my web server (in this way, my firewall is required to be re-configured); or

     c.) Others (please describe).

Thanks,

Stephen

[Seth Munroe]

1. For a .net code example of the validation see this post:

https://groups.google.com/d/msg/recaptcha/vgVtujCzHvs/yE2MmpPfCwAJ

2. Your webserver has to send an outbound request to and get a response from: https://www.google.com/recaptcha/api/siteverify

The user's display and handling of the recaptcha challenge is all communication between the user's browser and google's servers. The only thing you get is a request parameter value posted back to you. The parm is named g-recaptcha-response and it's value needs to be passed in your siteverify request.

Check out this article about validating the response:

https://developers.google.com/recaptcha/docs/verify

And this one about displaying the recaptcha challenge on the page:

https://developers.google.com/recaptcha/docs/display

-Seth

[Stephen Yip]

Dear Seth,

I will try for ASP.Net.

For firewall part, our firewall has been configured to bound outgoing traffic for security reasons and it seems that quite a lot of IPs may be involved to serve reCAPTCHA:

https://code.google.com/archive/p/recaptcha/wikis/FirewallsAndRecaptcha.wiki

The no. of IPs involved is too large and we don't want to skip the restrictions for all those IPs (our firewalls do not support bound by hostname).

How can we use reCAPTCHA under such condition, or we have to use CAPTCHA solution other than google?

Thanks,

Stephen

Seth Munroe於 2016年8月31日星期三 UTC+8下午11時36分17秒寫道：