I'm trying to make a page with an invisible reCAPTCHA and I am having trouble getting it to work.
Client Page:
<!DOCTYPE html>
<html lang="en">
<head>
<script src="https://code.jquery.com/jquery-2.2.1.min.js" integrity="sha384-8C+3bW/ArbXinsJduAjm9O7WNnuOcO+Bok/VScRYikawtvz4ZPrpXtGfKIewM9dK" crossorigin="anonymous"></script>
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0-beta.2/css/bootstrap.min.css" integrity="sha384-PsH8R72JQ3SOdhVi3uxftmaW6Vc51MKb0q5P2rRUpPvrszuE4W1povHYgTpBfshb" crossorigin="anonymous">
<script>
$('#formcomplete').click(function (e) {
grecaptcha.reset();
document.getElementById('form').checkValidity();
grecaptcha.execute();
return false;
});
function onSubmit(token) {
document.getElementById('form').submit();
}
</script>
<script src='https://www.google.com/recaptcha/api.js' async defer></script>
<style>
.centerize {
position: absolute;
left: 50%;
transform: translate(-50%, 0);
}
</style>
</head>
<body style="background-color: black; overflow: hidden;">
<form method='post' action='_resources/signup.php' id="form">
<div style="position: absolute; top: 50%; left: 50%; transform: translate(-50%, -50%); max-width: 50%;">
<div class="form-row">
<div class="form-group col-md-5">
<input type="text" class="form-control" name="name" placeholder="Name" size="64" required>
</div>
<div class="form-group col-md-7">
<input type='email' class='form-control' name='email' placeholder='email@example.com' size="64" required>
</div>
</div>
<div class="form-check" style="text-align: center;">
<label class="form-check-label" style="color: white">
<input type="checkbox" class="form-check-input" name="emaillist" value="emaillisttrue">
Add me to the email list to learn about future releases.
</label>
</div>
<div class="form-check" style="text-align: center;">
<label class="form-check-label" style="color: white">
<input type="checkbox" class="form-check-input" name="tac" value="tactrue" required>
I accept the <a href="./legal.html" onclick="window.open(this.href, 'mywin', 'left=20,top=20,width=500,height=500,toolbar=1,resizable=0'); return false;" >Terms and Conditions & Privacy Policy</a>.
</label>
</div>
<button class='btn btn-default centerize' id="formcomplete">Submit</button>
</div>
<div id='recaptcha' class="g-recaptcha"
data-sitekey="keeeeey"
data-callback="onSubmit"
data-theme="dark"
data-size="invisible">
</div>
</form>
</body>
and the Server Side validation:
<?php
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
$name = stripslashes($_POST['name']);
$email = stripslashes($_POST['email']);
$emaillist = stripslashes($_POST['emaillist']);
$tac = stripslashes($_POST['tac']);
//... verify that you have a name email and accepted the terms
$verify = file_get_contents("https://www.google.com/recaptcha/api/siteverify",false,stream_context_create(array(
'http' => array(
'method' => 'POST',
'content' => http_build_query(array(
'secret' => 'keeeeey',
'response' => $_POST['g-recaptcha-response'],
'remoteip' => $_SERVER['REMOTE_ADDR']
))
)
)));
if (json_decode($verify)->success==true) {
//... handle normal case
} else {
var_dump($verify);
//header("Location: ...");
}
}
When I browse to the page everything shows up fine, input is validated (chrome shows "please check this box to continue" if you didn't), and everything works up until I hit submit. After hitting submit I get directed to the form's POST endpoint at which the var_dump throws a discouraging string(75) "{ "success": false, "error-codes": [ "missing-input-response" ] }".
Now here's what perplexes me. If I browse to the page, fill in all the details and then open up the chrome dev console and enter grecaptcha.execute(); the form gets submitted and everything works fine, the reCAPTCHA request goes fine, and all the stuff that happens during the successful verify path server side happens. I have no idea why this happens.
Thanks for your help.
