Infrastructure/logto
0
Fork 0
mirror of https://github.com/logto-io/logto.git synced 2025-04-07 23:01:25 -05:00
Code Issues Activity

fix(core): fix recaptcha verification (#7224)

Browse source
This commit is contained in:
wangsijie 2025-04-02 14:45:33 +08:00 • committed by GitHub
parent d069541b78
commit 02baecf0c5
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 18 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

31
packages/core/src/routes/experience/classes/libraries/captcha-validator.ts
View file

@ -61,19 +61,23 @@ export class CaptchaValidator {
private async verifyRecaptchaEnterprise(config: RecaptchaEnterpriseConfig, captchaToken: string) {
try {
const result = await ky.post(
`https://recaptchaenterprise.googleapis.com/v1/projects/${config.projectId}/assessments?key=${config.secretKey}`,
{
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
token: captchaToken,
siteKey: config.siteKey,
// We can't decide the action here, because the interaction event may change after the user interaction.
// So we use a fixed action here.
expectedAction: 'interaction',
}),
}
);
const result = await ky
.post(
`https://recaptchaenterprise.googleapis.com/v1/projects/${config.projectId}/assessments?key=${config.secretKey}`,
{
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
event: {
token: captchaToken,
siteKey: config.siteKey,
// We can't decide the action here, because the interaction event may change after the user interaction.
// So we use a fixed action here.
expectedAction: 'interaction',
},
}),
}
)
.json();
const responseGuard = z.object({
tokenProperties: z.object({
@ -89,6 +93,7 @@ export class CaptchaValidator {
riskAnalysis: { score },
} = responseGuard.parse(result);
// TODO: customize the score threshold
return valid && score >= 0.5;
} catch {
return false;