Getting 400 error on /recaptcha/enterprise/clr automatically executed after obtaining reCAPTCHA token

Google Cloud Compute Infrastructure
1

Hello,
I am currently developing an Android/iOS application using the Ionic framework.

I am trying to implement reCAPTCHA in my app. I was able to successfully obtain a token through /recaptcha/enterprise/reload, but immediately afterward, a request to /recaptcha/enterprise/clr is made and it results in a 400 error.

The token itself is being generated correctly, and I have confirmed that the token can be used for verification.
My question is: Is it expected behavior that /recaptcha/enterprise/clr returns a 400 error, and should I just ignore it?

This text was translated, so I apologize if there are any unnatural expressions.
Thank you in advance for your support.

2

Hi @N.K,

According to this documentation the error is given when the request is malformed.

  • It is recommended that you avoid sending the same reCAPTCHA token multiple times. If your application requires retrying an Assessment API call, you should generate a new token for each retry attempt.

Another thing is that you must validate first that your token is present before you submit the form.

Although 400 error doesn’t seem to affect token generation or verification, it will still cause future risk. These erroneous requests clutter server logs and may increase load and this is not an expected behavior.

Check reCAPTCHA v3 & Integrate reCAPTCHA with iOS apps - for reference on implementing recaptcha.

You may also reach out to Google Cloud Support for more detailed insights and assistance.

3

Hi, @diannemcm
Thank you for the information!
I’m sorry, my explanation was insufficient and may have caused some misunderstanding.
The error occurs not on the backend, but on the frontend side.

Here are the implementation details:

// RecaptchaService class
execute(action: string): Promise<string> {
  return new Promise((resolve, reject) => {
    if (!window.hasOwnProperty('grecaptcha')) {
      reject('reCAPTCHA script not loaded');
      return;
    }

    grecaptcha.enterprise.ready(() => {
      grecaptcha.enterprise.execute(this.siteKey, { action })
        .then((token: string) => resolve(token))
        .catch((err: any) => reject(err));
    });
  });
}

// execute
const token = await this.recaptchaService.execute('test');

When I execute this code, the API /recaptcha/enterprise/reload is called to obtain the token, and afterward another API /recaptcha/enterprise/clr is executed.
Since this API is not documented, I’m not sure what it is supposed to do, but it is currently returning a 400 error.

If you have any knowledge about this behavior, I would really appreciate your guidance.
I will attach the error details from where the issue occurs.

Thank you.

image