SecretKey должен хранится
исключительно на сервере. И на сервере рекапча проверяется при помощи sitekey и secret key. Вот примерно как это происходит:
function v2_captcha_token_checker($v2_captcha_tokens, $secret_key){
// return false;
// return true;
$ch = curl_init();
$data = array(
'secret' => $secret_key,
'response' => $v2_captcha_token
);
curl_setopt_array($ch, [
CURLOPT_HEADER => 0,
CURLOPT_POST => true,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_SSL_VERIFYPEER => false,
CURLOPT_URL => 'https://www.google.com/recaptcha/api/siteverify',
CURLOPT_POSTFIELDS => http_build_query($data)
]);
$response = json_decode(curl_exec($ch), true);
if($response['success']){
return true;
}
else{
return false;
}
}
function captcha_response_check()
{
include ("captcha_v2_invisible_cnf.php");
global $answer;
if (
(!isset($_POST['captcha_v2_invisible_token'])) ||
($_POST['captcha_v2_invisible_token'] == ""))
{
$answer["status"] = "ERROR";
$answer["message"] = 'BAD REQUEST: POST captcha_v2_invisible_token param is required';
http_response_code(400);
echo json_encode($answer);
exit;
}
$captcha_v2_invisible_token = $_POST['captcha_v2_invisible_token'];
$secret_key = $captcha_v2_invisible_cnf['secret_key'];
$captcha_v2_invisible_token_is_ok = v2_captcha_token_checker($captcha_v2_invisible_token, $secret_key);
if ($captcha_v2_invisible_token_is_ok)
{
$answer["captcha_v2_invisible_token_is_valid"] = true;
}
else
{
$answer["captcha_v2_invisible_token_is_valid"] = false;
http_response_code(400);
$answer["status"] = "ERROR";
$answer["message"] = 'captcha v2 invisible token is not valid';
echo json_encode($answer);
exit;
}
}
