Server-side validation
Introduction
You have to validate the user's response to the CAPTCHA on your server. The token should be considered valid only if you validated it on your backend, otherwise it can be easily spoofed (the presence of the token in the request is not enough to consider it valid as an attacker can easily send a request with any string as a token).
The validation endpoint accepts the CAPTCHA token and your project-specific secret key and returns a JSON response with the validation result.
Token validation can only be performed once, if you try to validate the same token twice, the second validation will fail. This is done to prevent token reuse attacks.
To validate the token, you have to send a POST request to the https://api.swetrixcaptcha.com/v1/captcha/validate URL, with the following parameters:
| Parameter | Type | Description |
|---|---|---|
| token | string | The token returned by the CAPTCHA widget. |
| secret | string | Your CAPTCHA project secret key. |
The successful response will have the success field set to true and the data field will contain the following fields:
| Field | Type | Description |
|---|---|---|
| challenge | string | The challenge ID that was solved by the widget. |
| timestamp | number | The timestamp when the CAPTCHA token was issued. |
| pid | string | The ID of the CAPTCHA project. |
{
"success": true,
"data": {
"challenge": "CHALLENGE_12345678",
"timestamp": 1111111111,
"pid": "PROJECTID123"
}
}The failed response will throw an error that will look like the following example. The HTTP status code will correspond to the statusCode in JSON.
{
"statusCode": 400,
"message": "Could not decrypt token",
"error": "Bad Request"
}Here's an example of how to validate the token using curl:
curl -X POST\
-H "Content-Type: application/json"\
-d '{"token": "<token>", "secret": "<secret>"}'\
https://api.swetrixcaptcha.com/v1/captcha/validate
Help us improve Swetrix
Was this page helpful to you?