Fix reCAPTCHA v3 on AJAX forms + add it to signup - #108
Merged
Conversation
The v3 helper's submit hook ran in the capture phase and only preventDefault()'d — it
didn't stop the form's own AJAX handler, which fired instantly with an empty token, and it
never re-armed, so retries reused a spent token. That broke login/forgot/reset/otp the
moment reCAPTCHA was enabled ("your security token expired"). Add stopImmediatePropagation
(hold the AJAX handler until the async token exists) + re-arm per submit. One fix repairs
every form-submit AJAX form at once.
Signup (a public, account-creating form) had NO reCAPTCHA. It's a button-click AJAX submit,
so it mints the v3 token before the /api call (like the shop subscribe form) and validates
server-side with Tiger_Validate_Recaptcha. Renders the badge via $this->formRecaptcha.
Coverage after this: login/forgot/reset/otp (helper) + signup here + shop subscribe.
No other guest-facing submit forms exist. No-op when reCAPTCHA is disabled.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The bug
The v3 helper's submit hook (
Tiger_View_Helper_FormRecaptcha::_v3) ran in the capture phase and onlypreventDefault()'d — it did not stop the form's own AJAX handler, which fired immediately with an empty token, and it never re-armed, so retries reused a spent token. That hard-blocked login / forgot / reset / otp the moment reCAPTCHA was enabled ("your security token expired"). Two lines fix it:stopImmediatePropagation()(hold the AJAX handler until the async token exists) + re-arm per submit. One fix repairs every form-submit AJAX form at once.Signup
The signup form (public, account-creating) had no reCAPTCHA. It's a button-click AJAX submit (not a native form submit), so it mints the v3 token before the
/apicall — the same pattern as the shop subscribe form — and validates server-side withTiger_Validate_Recaptcha. The badge renders via$this->formRecaptcha.Coverage after this
login / forgot / reset / otp (helper) · signup (here) · shop subscribe (TigerShop). Audited the guest-allowed services — no other guest-facing submit forms exist. No-op when reCAPTCHA is disabled;
fail_opencovers a Google outage.Verified
Login confirmed working with reCAPTCHA v3 on dev-com (the helper fix). Unit: FormRecaptcha + the new Hash element test green.
🤖 Generated with Claude Code