如何信任 AJAX 验证码请求？
recaptcha API 允许纯 JavaScript 验证码创建和验证。但是，网站如何才能相信用户确实通过这种方式解决了验证码呢？他们怎么知道他们不只是改变了 javascript？
如果所有的计算都是由用户完成的，那么作为后端我们怎么能相信他们发送给我们的结果呢？
例如，假设您正在使用后端功能（例如发送激活电子邮件），该功能要求您的新用户证明他们是人类。使用普通 API，您的后端可以调用 reCaptcha 并确认（因为我们可以信任 reCaptcha）。通过 AJAX 验证，用户代理基本上会说“我解决了验证码 - 你可以相信我！”到你的后端。
我错过了什么吗？
The recaptcha API allows pure JavaScript captcha creating and verifying. But, how can a site trust that the user actually solved the captcha this way? How do they know they didn't just alter the javascript?
If all calculations are done by the user, then as the backend how can we trust the result that they send us?
For example, lets say you were using a backend function (like sending an activation email) that requires your new users to prove they are human. With the normal API your backend could call reCaptcha and confirm (since we can trust recaptcha). With an AJAX verification the user agents are basically saying "I solved the recaptcha - you can trust me!" to your backend.
Am I missing something?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
来自文档：
而验证部分需要在服务器上完成。
基本上，当您进行验证时，您需要通过向服务器发送质询和响应来自行向服务器发出 AJAX 请求。
然后，您服务器上的脚本可以使用 reCaptcha 进行验证，并将结果返回到您的网页。您的后端脚本可能必须存储一些会话变量，表明用户已通过验证码测试。
From the docs:
And the verification part needs to be done on the server.
Basically, when you validate, you need to make an AJAX request to your server yourself by sending the challenge and response to your server.
A script on your server can then verify with reCaptcha and returns the result back to to your web page. Your backend script may have to store some session variable saying that the user has passed a captcha test.