Protect public routes from spam through recaptcha
The motivation behind this module was to protect an api endpoint, for user signups from spam. Therefore this module does not deal with the client side of recaptcha at all.
Install the module with npm
npm install -save express-recaptcha-rest
Once installed require it and add it as middleware to a route.
const express = require('express')
const recaptcha = require('express-recaptcha-rest')
const app = express()
app.post('/some/route', recaptcha({ secret: 'your_secret' }), routeHandler)
-
field
- The name of the filed to look for the recaptcha response in the request
- Per default it is set to 'g-recaptcha-response'
- The middleware looks for the response in the following order: headers, query, body
-
secret
- The secret to use in the verification request
- If set to 'test_secret' a fixed secret is used which will always make the verification request succeed. Here are some more infos.
If the recaptcha response supplied by the client is invalid the middleware ends the response with a 422 status. Middleware and handlers which are further down the line won't get executed.
If the client does not send any recaptcha response at all or not under the in options specified key the response will end with a 400 status.
The middleware adds a req.recaptcha
property to the request.
This property holds the response from the verification request.
If the middleware finds req.recaptcha
set to false, by an early
middleware, verification will be skipped.
The following errors will be passed to next as the only argument.
This error indicates that the verification request could not be sent.
Should the response to the verification request have any other status than 200 this error is given.
If the JSON in the body of the response can not be parsed you will see this error.
This error shows that the request it self was invalid, most likely an invalid recaptcha secret.