Is it possible to detect if the Invisible Recaptcha was shown to a user?

Question

In my web page, I validate a form based on Invisible Recaptcha, by calling the calling the function grecaptcha.execute(). Usually this happens invisible to the user; all they see is the form submit that is triggered after grecaptcha is done verifying.

Sometimes, the not-so-Invisible Recaptcha behaviour is triggered (e.g. if the user behaves suspiciously) and a regular captcha is shown to the user that they must solve. When this happens, I want to detect it programmatically.

Is it possible to programmatically discover if a captcha was shown to the user after the call to grecaptcha.execute()?

So far, I've experimented with watching the DOM using MutationEvents and MutationObservers. Unfortunately everything interesting is happening inside an iframe and it seems to be impossible to tell if the full captcha was shown or not.

I don't want to measure how long it takes for grecaptcha to call the callback I give it, because that would be unreliable (e.g. slow mobile connections would skew the results).

Markup:

<form id="form" method="post" action="/form">
    Name: (required) <input id="name" name="name">
    <div id="g-recaptcha-div"
        class="g-recaptcha"
        data-sitekey="keeeey"
        data-callback="onRecaptchaDone"
        data-size="invisible"></div>
    <button id="thebutton">Submit</button>
</form>

Code:

function onSubmit(event) {
    event.preventDefault();
    grecaptcha.reset();
    grecaptcha.execute();
}
function onRecaptchaDone(token) {
    form.submit();
}
window.onload = function() {
    form.onsubmit = onSubmit;
}

How you are using recaptcha, do you have a callback for recaptcha on submit? How you rendering it? — The Alpha, Feb 12 '18 at 17:25
Yes sorry - I do have a callback. It gets called with the token provided by the recaptcha API. But it gets called every time in the same way, regardless of whether the captcha was shown. — Robert Steward, Feb 12 '18 at 17:27
Can you show your code here? Initializing of the recaptcha? I mean, are you using `grecaptcha.render(...)`? — The Alpha, Feb 12 '18 at 17:28
I've added it to the question. I'm using the invisible API, so no call to `render`. — Robert Steward, Feb 12 '18 at 17:35
Where is you `grecaptcha.execute()` being executed, in form submit method or what? — The Alpha, Feb 12 '18 at 17:36
@SujanAdiga no, I didn't. I guess it is intentionally hard or impossible to prevent us from gaming the system. — Robert Steward, Apr 25 '19 at 14:30

Is it possible to detect if the Invisible Recaptcha was shown to a user?

0 Answers0