Google reCAPTCHA Validation Issue (accepts anything including blank) - asp-classic

Question

I'm attempting to implement Google's reCAPTCHA on a Classic ASP site and am attempting to follow the guidelines outline here:
https://developers.google.com/recaptcha/docs/asp
Following the instructions on that page, I've added this code to the top of the page that contains the form:
<%
recaptcha_challenge_field = Request("recaptcha_challenge_field")
recaptcha_response_field = Request("recaptcha_response_field")
recaptcha_public_key = "<font color=red>your_public_key</font>" ' your public key
recaptcha_private_key = "<font color=red>your_private_key</font>" ' your private key
' returns the HTML for the widget
function recaptcha_challenge_writer()
recaptcha_challenge_writer = _
"<script type=""text/javascript"">" & _
"var RecaptchaOptions = {" & _
" theme : 'red'," & _
" tabindex : 0" & _
"};" & _
"</script>" & _
"<script type=""text/javascript"" src=""http://www.google.com/recaptcha/api/challenge?k=" & recaptcha_public_key & """></script>" & _
"<noscript>" & _
"<iframe src=""http://www.google.com/recaptcha/api/noscript?k=" & recaptcha_public_key & """ frameborder=""1""></iframe><br>" & _
"<textarea name=""recaptcha_challenge_field"" rows=""3""cols=""40""></textarea>" & _
"<input type=""hidden"" name=""recaptcha_response_field""value=""manual_challenge"">" & _
"</noscript>"
end function
' returns "" if correct, otherwise it returns the error response
function recaptcha_confirm(rechallenge,reresponse)
Dim VarString
VarString = _
"privatekey=" & recaptcha_private_key & _
"&remoteip=" & Request.ServerVariables("REMOTE_ADDR") & _
"&challenge=" & rechallenge & _
"&response=" & reresponse
Dim objXmlHttp
Set objXmlHttp = Server.CreateObject("Msxml2.ServerXMLHTTP")
objXmlHttp.open "POST", "http://www.google.com/recaptcha/api/verify", False
objXmlHttp.setRequestHeader "Content-Type", "application/x-www-form-urlencoded"
objXmlHttp.send VarString
Dim ResponseString
ResponseString = split(objXmlHttp.responseText, vblf)
Set objXmlHttp = Nothing
if ResponseString(0) = "true" then
'They answered correctly
recaptcha_confirm = ""
else
'They answered incorrectly
recaptcha_confirm = ResponseString(1)
end if
end function
server_response = ""
newCaptcha = True
if (recaptcha_challenge_field <> "" or recaptcha_response_field <> "") then
server_response = recaptcha_confirm(recaptcha_challenge_field, recaptcha_response_field)
newCaptcha = False
end if
%>
Also per that page, I've added this code to the form itself to generate the reCAPTCHA widget:
<% if server_response <> "" or newCaptcha then %>
<% if newCaptcha = False then %>
<!-- An error occurred -->
Wrong!
<% end if %>
<%=recaptcha_challenge_writer()%>
<% else %>
<!-- The solution was correct -->
Correct!
<%end if%>
I can get the CAPTCHA to display properly, but it isn't verifying - it will accept any answer including being left blank. I believe some of the code needs to be added to my script that actually handles the data, but am not sure which code or where to put it.
I've tried moving portions of the above code that appear to be for validation purposes to the script that processes the responses and generates an e-mail, but have had no luck there either.
The for page can be viewed here:
http://www.onlyproforma.com/mktimg/landingPage_ResultsFirst4_CAPTCHA.asp
I am aware there are other options, but I would like to get this one working if possible.
Any help is greatly appreciated.

Answer 1

I had a similar issue especially with the NEW reCAPTCHA tick functionality. If you look at the reCAPTCHA admin site which gives you your public and private (secret) keys, you'll see that the server side integration URL to verify, is different from the code above. In the code above, the verify URL is _http://www.google.com/recaptcha/api/verify whereas the verify URL supplied by the reCAPTCHA admin page is _https://www.google.com/recaptcha/api/siteverify. Very different.
Also, the parameters required are different. In the above code, there is a call for Request("recaptcha_challenge_field") and Request("recaptcha_response_field"). Yet the new reCAPTCHA verify only requires the response field. But even that has changed! It is now request.form("g-recaptcha-response").
Granted, the code that you are using above comes straight from Google themselves (https://developers.google.com/recaptcha/old/docs/asp). But it appears that this code is outdated, especially if you consider that it is filed in a directory called OLD.
So this is what worked for me!
Dim recaptcha_secret
recaptcha_secret = "your secret code"
Dim sendstring
sendstring = _
"https://www.google.com/recaptcha/api/siteverify?" & _
"secret=" & recaptcha_secret & _
"&response=" & request.form("g-recaptcha-response")
Set objXML = Server.CreateObject("MSXML2.ServerXMLHTTP")
objXML.Open "GET", sendstring , false
objXML.Send()
The code below reads the response from Google. The reply comes back as a JSON object, but I cannot read or process the JSON response on the server-side and I could not find an easy method.
So the workaround was to search for the string 'true'. If it returned TRUE (positive) then the reCAPTCHA was confirmed. If it does not return TRUE, then the response is essentially
FALSE and the reCAPTCHA was not submitted correctly.
It is ugly but it works:
if instr(objXML.responseText,"true") then
response.redirect "to an appropriate page"
else
response.redirect "to an appropriate page"
end if
Maybe there is a neater way to read the Google reply, but I have tested it and it works for me.
The full code then would look like this:
<%
Dim recaptcha_secret
recaptcha_secret = "your secret code"
Dim sendstring
sendstring = _
"https://www.google.com/recaptcha/api/siteverify?" & _
"secret=" & recaptcha_secret & _
"&response=" & request.form("g-recaptcha-response")
Set objXML = Server.CreateObject("MSXML2.ServerXMLHTTP")
objXML.Open "GET", sendstring , false
objXML.Send()
if instr(objXML.responseText,"true") then
response.redirect "to an appropriate page"
else
response.redirect "to an appropriate page"
end if
%>

Answer 2

The following code will go in the page where the form is posted. i.e. in your case L_Landing_actionJCR.asp
<% if server_response <> "" then %>
Wrong!
<% else %>
Correct!
<% else %>