Implement Google reCAPTCHA In ASP.NET MVC

In the action, we will need to add FormCollection in the parameter as g-recaptcha-response cannot be made into a parameter as .Net doesn’t allow – (hyphen/dash) in the variable name.

We then verify the response by posting it to this URL.

Google returns JSON in the below format.

{
    "success": true|false,
    "challenge_ts": "timestamp", // timestamp of the challenge load (ISO format yyyy-MM-dd'T'HH:mm:ssZZ)
    "hostname": "string", // the hostname of the site where the reCAPTCHA was solved
    "error-codes": [...] // optional
}

When success is true, it means the Captcha is verified, if it's false then the user has not passed reCaptcha test, and you can check error codes for additional errors.

I’ve provided a sample implementation. Please check the code below.

[HttpPost]
public ActionResult ABCD(FormCollection form)
{
    if (string.IsNullOrWhiteSpace(form["g-recaptcha-response"]))
    {
        // Throw error as required
    }
    ReCaptchaResponse reCaptchaResponse = VerifyCaptcha("xxxxSecret Keyxxxx", form["g-recaptcha-response"]);

    if (!reCaptchaResponse.success)
    {
        // Throw error as required
        // You can also log errors returned from Google in reCaptchaResponse.error_codes
    }
    // Additional logic
}
// Function ... you can create it in a different class
public static ReCaptchaResponse VerifyCaptcha(string secret, string response)
{
    if (response != null)
    {
        using (System.Net.Http.HttpClient hc = new System.Net.Http.HttpClient())
        {
            var values = new Dictionary<string, string>
            {
                { "secret", secret },
                { "response", response }
            };
            var content = new System.Net.Http.FormUrlEncodedContent(values);
            var response = hc.PostAsync("https://www.google.com/recaptcha/api/siteverify", content).Result;
            var responseString = response.Content.ReadAsStringAsync().Result;
            if (!string.IsNullOrWhiteSpace(responseString))
            {
                ReCaptchaResponse captchaResponse = JsonConvert.DeserializeObject<ReCaptchaResponse>(responseString);
                return captchaResponse;
            }
            else
            {
                // Throw error as required
            }
        }
    }
    else
    {
        // Throw error as required
    }
    return null; // Ensure to return a valid response or handle errors as needed
}
// You can use http://json2csharp.com/ to create C# classes from JSON
// Note: "error-codes" is an invalid name for a variable in C# so we use "_" and then add JsonProperty to it
public class ReCaptchaResponse
{
    public bool success { get; set; }
    public string challenge_ts { get; set; }
    public string hostname { get; set; }
    [JsonProperty(PropertyName = "error-codes")]
    public List<string> error_codes { get; set; }
}

Future

Google soon plans on releasing Invisible reCAPTCHA. It’s now available as Beta.

References

• https://developers.google.com/recaptcha/intro
• https://www.google.com/recaptcha
• https://en.wikipedia.org/wiki/ReCAPTCHA