Skip to content

Add error handling for failed reCAPTCHA execute#11449

Merged
aduth merged 3 commits intomainfrom
aduth-recaptcha-error-execute
Nov 5, 2024
Merged

Add error handling for failed reCAPTCHA execute#11449
aduth merged 3 commits intomainfrom
aduth-recaptcha-error-execute

Conversation

@aduth
Copy link
Contributor

@aduth aduth commented Nov 4, 2024

🛠 Summary of changes

Improves the behavior of reCAPTCHA submit buttons to ensure that a misconfigured reCAPTCHA environment does not prevent form submission.

Ideally this should never happen, since we would configure an environment correctly, but this adds additional resilience to handle if it were misconfigured. Prior to these changes, it'd be very hard to tell that there was an issue, because we would not receive events corresponding to the submission.

📜 Testing Plan

Validate that if reCAPTCHA is misconfigured, you're still able to sign in.

Configure reCAPTCHA in a way that uses invalid credentials:

# config/application.yml
development:
  recaptcha_site_key: 'test'
  recaptcha_enterprise_api_key: 'test'
  recaptcha_enterprise_project_id: 'test'
  recaptcha_mock_validator: false
  sign_in_recaptcha_score_threshold: 0.3
  sign_in_recaptcha_percent_tested: 100
  1. In a separate terminal process, run make watch_events
  2. In a private browsing window, go to http://localhost:3000
  3. Enter email and password
  4. Click "Sign in"

Before:

  • As a user, the submit button shows as stuck spinning
  • In logs, there are no events received

After:

  • As a user, you're redirected to MFA
  • In logs:
    • There is a "reCAPTCHA verify result received" event with "PERMISSION_DENIED" error and "evaluated_as_valid": true property
    • There is a "Email and Password Authentication" event with "captcha_validation_performed": true and "valid_captcha_result": true
    • It can't be easily validated, but the error will also be logged to NewRelic

👀 Screenshots

Before After
image (Redirected to MFA)
image

changelog: Internal, reCAPTCHA, Add error handling for failed reCAPTCHA execute
@aduth aduth requested a review from a team November 4, 2024 21:01
Copy link
Contributor

@kevinsmaster5 kevinsmaster5 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good. Works as expected in local testing.

@aduth aduth merged commit 00f7db0 into main Nov 5, 2024
@aduth aduth deleted the aduth-recaptcha-error-execute branch November 5, 2024 13:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants