Creare valutazioni per i siti web

Questa pagina spiega come creare una valutazione per consentire al tuo backend di per verificare l'autenticità del token Inviati da reCAPTCHA. reCAPTCHA invia una risposta criptata, il token di risposta reCAPTCHA (noto anche come token), quando l'utente finale attiva un'azione HTML.

Per qualsiasi tipo di integrazione della chiave reCAPTCHA (casella di controllo o punteggio), devi creare una valutazione per valutare i risultati di execute() nel tuo backend inviando il token generato a l'endpoint di valutazione. reCAPTCHA elabora inviato e ne segnala la validità e il punteggio.

Le prime 10.000 valutazioni mensili reCAPTCHA sono gratuiti. Per continuare a creare test dopo aver raggiunto il livello mensile gratuito di utilizzo massimo (10.000 valutazioni al mese), devi abilitare per il tuo progetto Google Cloud. Per ulteriori informazioni sulla fatturazione per reCAPTCHA, consulta Informazioni di fatturazione.

Prima di iniziare

  1. Prepara l'ambiente per reCAPTCHA.
  2. Assicurati di disporre del seguente ruolo di gestione dell'identità e dell'accesso: Agente reCAPTCHA Enterprise (roles/recaptchaenterprise.agent).
  3. Installa chiavi basate sul punteggio o chiavi delle caselle di controllo sul tuo sito web.
  4. Configura l'autenticazione a reCAPTCHA.

    Il metodo di autenticazione che scegli dipende dall'ambiente in cui è configurato reCAPTCHA. La seguente tabella ti aiuta a scegliere il metodo di autenticazione appropriato e l'interfaccia supportata per configurare l'autenticazione:

    Ambiente Interfaccia Metodo di autenticazione
    Google Cloud
    • REST
    • Librerie client
    		 Utilizza account di servizio collegati.
    On-premise o un altro provider cloud REST Utilizza le chiavi API o la federazione delle identità per i carichi di lavoro.

    Se vuoi utilizzare le chiavi API, ti consigliamo di proteggerle applicando limitazioni relative alle chiavi API.
    Librerie client

    Utilizza quanto segue:

Recuperare un token

Recupera un token dalle pagine web in uno dei seguenti modi:

  • Il valore risolto della promessa restituita dalla chiamata a grecaptcha.enterprise.execute().
  • Utilizza il parametro POST g-recaptcha-response quando un utente invia un modulo sul tuo sito.
  • Come argomento stringa per la funzione di callback se data-callback è specificato nell'attributo del tag HTMLg-recaptcha o nel parametro callback nel metodo grecaptcha.enterprise.render.

Puoi accedere al token di ciascun utente solo una volta. Se devi valutare un'azione successiva intrapresa da un utente sul tuo sito o se un token scade prima che venga creata una valutazione, devi chiamare di nuovo execute() per generare un nuovo token.

Creare una valutazione

Dopo aver configurato l'autenticazione, crea una valutazione inviando una richiesta all'API reCAPTCHA Enterprise o utilizzando le librerie client di reCAPTCHA.

Per migliorare il rilevamento, ti consigliamo di passare i seguenti valori aggiuntivi durante la creazione delle valutazioni:

  • userAgent: lo user agent è incluso nella richiesta HTTP nell'intestazione della richiesta. Per ulteriori informazioni, leggi l'articolo Informazioni sull'intestazione della richiesta User-Agent nella documentazione di Mozilla Developer Network.
  • userIpAddress: l'indirizzo IP dell'utente che invia una richiesta al tuo backend è disponibile nella richiesta HTTP. Se utilizzi un server proxy, l'indirizzo IP è disponibile nell'intestazione della richiesta X-Forwarded-For. Per saperne di più su come ottenere l'indirizzo IP, vedi X-Forwarded-For.
  • ja3: JA3 è un metodo open source per il fingerprinting dei client TLS. Per ulteriori informazioni sull'utilizzo di JA3 per creare un'impronta TLS, consulta la documentazione di JA3, .

In questo modo, puoi proteggere il tuo sito web e le tue applicazioni mobile da pattern di attacco avanzati e da comportamenti illeciti da parte di utenti.

Il modo in cui crei una valutazione è lo stesso per le chiavi basate sul punteggio e sulle caselle di controllo.

API REST

Crea una valutazione inviando una richiesta all'API reCAPTCHA. Per l'autenticazione puoi utilizzare l'interfaccia a riga di comando gcloud o la chiave API.

Utilizza gcloud CLI

Crea una valutazione utilizzando il metodo projects.assessments.create. Invia questa richiesta all'endpoint API v1.

Prima di utilizzare i dati della richiesta, apporta le seguenti sostituzioni:

  • PROJECT_ID: il tuo ID progetto Google Cloud
  • TOKEN: token restituito dalla chiamata grecaptcha.enterprise.execute()
  • KEY_ID: la chiave reCAPTCHA associata al sito o all'app. Per ulteriori informazioni, consulta la sezione Chiavi reCAPTCHA.
  • USER_AGENT: lo user agent nella richiesta dal dispositivo dell'utente.
  • USER_IP_ADDRESS: l'indirizzo IP nella richiesta dal dispositivo dell'utente.
  • JA3: fingerprint JA3 per il client SSL. Consigliamo di utilizzare salesforce/ja3 per calcolare JA3.
  • USER_ACTION: l'azione avviata dall'utente specificata per action nella chiamata grecaptcha.enterprise.execute(), ad esempio login.

    Per ulteriori informazioni, consulta Nomi delle azioni.

Metodo HTTP e URL: 

POST https://recaptchaenterprise.googleapis.com/v1/projects/PROJECT_ID/assessments

Corpo JSON della richiesta: 

{
  "event": {
    "token": "TOKEN",
    "siteKey": "KEY_ID",
    "userAgent": "USER_AGENT",
    "userIpAddress": "USER_IP_ADDRESS",
    "ja3": "JA3",
    "expectedAction": "USER_ACTION"
  }
}

Per inviare la richiesta, scegli una delle seguenti opzioni:

curl

Salva il corpo della richiesta in un file denominato request.json, quindi esegui il comando seguente: 

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://recaptchaenterprise.googleapis.com/v1/projects/PROJECT_ID/assessments"

PowerShell

Salva il corpo della richiesta in un file denominato request.json, quindi esegui il comando seguente: 

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method POST `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://recaptchaenterprise.googleapis.com/v1/projects/PROJECT_ID/assessments" | Select-Object -Expand Content

Dovresti ricevere una risposta JSON simile alla seguente:

{
  "tokenProperties": {
    "valid": true,
    "hostname": "www.google.com",
    "action": "homepage",
    "createTime": "2019-03-28T12:24:17.894Z"
   },
  "riskAnalysis": {
    "score": 0.1,
    "reasons": ["AUTOMATION"]
  },
 "event": {
    "token": "TOKEN",
    "siteKey": "KEY_ID",
    "userAgent": "USER_AGENT",
    "userIpAddress": "USER_IP_ADDRESS",
    "ja3": "JA3",
    "expectedAction": "USER_ACTION"
  },
  "name": "projects/PROJECT_NUMBER/assessments/b6ac310000000000"
}

Ti consigliamo di utilizzare qualsiasi parser JSON in modalità di analisi non rigida per evitare interruzioni nel caso in cui nella risposta JSON vengano introdotti campi aggiuntivi.

Utilizzare una chiave API

Crea una valutazione utilizzando il metodo projects.assessments.create. Invia questa richiesta all'endpoint dell'API v1.

Prima di utilizzare i dati della richiesta, effettua le seguenti sostituzioni:

  • API_KEY: la chiave API associata al progetto corrente
  • PROJECT_ID: l'ID del tuo progetto Google Cloud
  • TOKEN: token restituito dalla chiamata grecaptcha.enterprise.execute()
  • KEY_ID: la chiave reCAPTCHA associata al sito o all'app. Per ulteriori informazioni, consulta la sezione Chiavi reCAPTCHA.
  • USER_AGENT: lo user agent nella richiesta dal dispositivo dell'utente.
  • USER_IP_ADDRESS: l'indirizzo IP nella richiesta dal dispositivo dell'utente.
  • JA3: fingerprint JA3 per il client SSL. Consigliamo di utilizzare salesforce/ja3 per il calcolo di JA3.
  • USER_ACTION: l'azione avviata dall'utente che hai specificato per action nella chiamata grecaptcha.enterprise.execute(), ad esempio login.

    Per ulteriori informazioni, consulta la sezione Nomi delle azioni.

Metodo HTTP e URL: 

POST https://recaptchaenterprise.googleapis.com/v1/projects/PROJECT_ID/assessments?key=API_KEY

Corpo JSON della richiesta: 

{
  "event": {
    "token": "TOKEN",
    "siteKey": "KEY_ID",
    "userAgent": "USER_AGENT",
    "userIpAddress": "USER_IP_ADDRESS",
    "ja3": "JA3",
    "expectedAction": "USER_ACTION"
  }
}

Per inviare la richiesta, scegli una delle seguenti opzioni:

curl

Salva il corpo della richiesta in un file denominato request.json. ed esegui questo comando: 

curl -X POST \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://recaptchaenterprise.googleapis.com/v1/projects/PROJECT_ID/assessments?key=API_KEY"

PowerShell

Salva il corpo della richiesta in un file denominato request.json. ed esegui questo comando: 

$headers = @{  }

Invoke-WebRequest `
    -Method POST `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://recaptchaenterprise.googleapis.com/v1/projects/PROJECT_ID/assessments?key=API_KEY" | Select-Object -Expand Content

Dovresti ricevere una risposta JSON simile alla seguente:

{
  "tokenProperties": {
    "valid": true,
    "hostname": "www.google.com",
    "action": "homepage",
    "createTime": "2019-03-28T12:24:17.894Z"
   },
  "riskAnalysis": {
    "score": 0.1,
    "reasons": ["AUTOMATION"]
  },
  "event": {
    "token": "TOKEN",
    "siteKey": "KEY_ID",
    "userAgent": "USER_AGENT",
    "userIpAddress": "USER_IP_ADDRESS",
    "ja3": "JA3",
    "expectedAction": "USER_ACTION"
  },
  "name": "projects/PROJECT_NUMBER/assessments/b6ac310000000000"
}

Ti consigliamo di utilizzare qualsiasi parser JSON in modalità di analisi non rigida per evitare interruzioni nel caso in cui nella risposta JSON vengano introdotti campi aggiuntivi.

C#

  using System;
  using Google.Api.Gax.ResourceNames;
  using Google.Cloud.RecaptchaEnterprise.V1;

  public class CreateAssessmentSample
  {
      // Create an assessment to analyze the risk of a UI action.
      // projectID: Google Cloud project ID.
      // recaptchaKey: reCAPTCHA key obtained by registering a domain or an app to use reCAPTCHA Enterprise.
      // token: The token obtained from the client on passing the recaptchaKey.
      // recaptchaAction: Action name corresponding to the token.
      public void createAssessment(string projectID = "project-id", string recaptchaKey = "recaptcha-key",
          string token = "action-token", string recaptchaAction = "action-name")
      {

          // Create the client.
          // TODO: To avoid memory issues, move this client generation outside
          // of this example, and cache it (recommended) or call client.close()
          // before exiting this method.
          RecaptchaEnterpriseServiceClient client = RecaptchaEnterpriseServiceClient.Create();

          ProjectName projectName = new ProjectName(projectID);

          // Build the assessment request.
          CreateAssessmentRequest createAssessmentRequest = new CreateAssessmentRequest()
          {
              Assessment = new Assessment()
              {
                  // Set the properties of the event to be tracked.
                  Event = new Event()
                  {
                      SiteKey = recaptchaKey,
                      Token = token,
                      ExpectedAction = recaptchaAction
                  },
              },
              ParentAsProjectName = projectName
          };

          Assessment response = client.CreateAssessment(createAssessmentRequest);

          // Check if the token is valid.
          if (response.TokenProperties.Valid == false)
          {
              System.Console.WriteLine("The CreateAssessment call failed because the token was: " +
                  response.TokenProperties.InvalidReason.ToString());
              return;
          }

          // Check if the expected action was executed.
          if (response.TokenProperties.Action != recaptchaAction)
          {
              System.Console.WriteLine("The action attribute in reCAPTCHA tag is: " +
                  response.TokenProperties.Action.ToString());
              System.Console.WriteLine("The action attribute in the reCAPTCHA tag does not " +
                  "match the action you are expecting to score");
              return;
          }

          // Get the risk score and the reasons.
          // For more information on interpreting the assessment,
          // see: https://cloud.google.com/recaptcha/docs/interpret-assessment
          System.Console.WriteLine("The reCAPTCHA score is: " + ((decimal)response.RiskAnalysis.Score));

          foreach (RiskAnalysis.Types.ClassificationReason reason in response.RiskAnalysis.Reasons)
          {
              System.Console.WriteLine(reason.ToString());
          }
      }

      public static void Main(string[] args)
      {
          new CreateAssessmentSample().createAssessment();
      }
  }

Vai

  import (
    "context"
    "fmt"

    recaptcha "cloud.google.com/go/recaptchaenterprise/v2/apiv1"
    recaptchapb "cloud.google.com/go/recaptchaenterprise/v2/apiv1/recaptchaenterprisepb"
  )

  func main() {
    // TODO(developer): Replace these variables before running the sample.
    projectID := "project-id"
    recaptchaKey := "recaptcha-key"
    token := "action-token"
    recaptchaAction := "action-name"

    createAssessment(projectID, recaptchaKey, token, recaptchaAction)
  }

  /**
  * Create an assessment to analyze the risk of a UI action.
  *
  * @param projectID: Google Cloud project ID
  * @param recaptchaKey: reCAPTCHA key obtained by registering a domain or an app to use the services of reCAPTCHA Enterprise.
  * @param token: The token obtained from the client on passing the recaptchaKey.
  * @param recaptchaAction: Action name corresponding to the token.
  */
  func createAssessment(projectID string, recaptchaKey string, token string, recaptchaAction string) {

    // Create the recaptcha client.
    // TODO: To avoid memory issues, move this client generation outside
    // of this example, and cache it (recommended) or call client.close()
    // before exiting this method.
    ctx := context.Background()
    client, err := recaptcha.NewClient(ctx)
    if err != nil {
      fmt.Printf("Error creating reCAPTCHA client\n")
    }
    defer client.Close()

    // Set the properties of the event to be tracked.
    event := &recaptchapb.Event{
      Token:          token,
      SiteKey:        recaptchaKey,
    }

    assessment := &recaptchapb.Assessment{
      Event: event,
    }

    // Build the assessment request.
    request := &recaptchapb.CreateAssessmentRequest{
      Assessment: assessment,
      Parent:     fmt.Sprintf("projects/%s", projectID),
    }

    response, err := client.CreateAssessment(
      ctx,
      request)

    if err != nil {
      fmt.Printf("%v", err.Error())
    }

    // Check if the token is valid.
    if response.TokenProperties.Valid == false {
      fmt.Printf("The CreateAssessment() call failed because the token"+
         " was invalid for the following reasons: %v",
      response.TokenProperties.InvalidReason)
      return
    }

    // Check if the expected action was executed.
    if response.TokenProperties.Action == recaptchaAction {
      // Get the risk score and the reason(s).
      // For more information on interpreting the assessment,
      // see: https://cloud.google.com/recaptcha/docs/interpret-assessment
      fmt.Printf("The reCAPTCHA score for this token is:  %v",
        response.RiskAnalysis.Score)

      for _,reason := range response.RiskAnalysis.Reasons {
        fmt.Printf(reason.String()+"\n")
      }
      return
    }

    fmt.Printf("The action attribute in your reCAPTCHA tag does " +
        "not match the action you are expecting to score")
  }

Java


import com.google.cloud.recaptchaenterprise.v1.RecaptchaEnterpriseServiceClient;
import com.google.recaptchaenterprise.v1.Assessment;
import com.google.recaptchaenterprise.v1.CreateAssessmentRequest;
import com.google.recaptchaenterprise.v1.Event;
import com.google.recaptchaenterprise.v1.ProjectName;
import com.google.recaptchaenterprise.v1.RiskAnalysis.ClassificationReason;
import java.io.IOException;

public class CreateAssessment {

  public static void main(String[] args) throws IOException {
    // TODO(developer): Replace these variables before running the sample.
    String projectID = "project-id";
    String recaptchaSiteKey = "recaptcha-site-key";
    String token = "action-token";
    String recaptchaAction = "action-name";
    String userIpAddress = "user-ip-address";
    String userAgent = "user-agent";
    String ja3 = "ja3"

    createAssessment(projectID, recaptchaSiteKey, token, recaptchaAction, userIpAddress, userAgent, ja3);
  }

  /**
   * Create an assessment to analyze the risk of an UI action. Assessment approach is the same for
   * both 'score' and 'checkbox' type recaptcha site keys.
   *
   * @param projectID : GCloud Project ID
   * @param recaptchaSiteKey : Site key obtained by registering a domain/app to use recaptcha
   *     services. (score/ checkbox type)
   * @param token : The token obtained from the client on passing the recaptchaSiteKey.
   * @param recaptchaAction : Action name corresponding to the token.
   * @param userIpAddress: IP address of the user sending a request.
   * @param userAgent: User agent is included in the HTTP request in the request header. 
   * @param ja3: JA3 associated with the request.
   */
  public static void createAssessment(
      String projectID, String recaptchaSiteKey, String token, String recaptchaAction, String userIpAddress, String userAgent, String ja3)
      throws IOException {
    // Initialize client that will be used to send requests. This client only needs to be created
    // once, and can be reused for multiple requests. After completing all of your requests, call
    // the `client.close()` method on the client to safely
    // clean up any remaining background resources.
    try (RecaptchaEnterpriseServiceClient client = RecaptchaEnterpriseServiceClient.create()) {

      // Set the properties of the event to be tracked.
      Event event = Event.newBuilder()
          .setSiteKey(recaptchaSiteKey)
          .setToken(token)
          .setUserIpAddress(userIpAddress)
          .setJa3(ja3)
          .setUserAgent(userAgent)
          .build();

      // Build the assessment request.
      CreateAssessmentRequest createAssessmentRequest =
          CreateAssessmentRequest.newBuilder()
              .setParent(ProjectName.of(projectID).toString())
              .setAssessment(Assessment.newBuilder().setEvent(event).build())
              .build();

      Assessment response = client.createAssessment(createAssessmentRequest);

      // Check if the token is valid.
      if (!response.getTokenProperties().getValid()) {
        System.out.println(
            "The CreateAssessment call failed because the token was: "
                + response.getTokenProperties().getInvalidReason().name());
        return;
      }

      // Check if the expected action was executed.
      // (If the key is checkbox type and 'action' attribute wasn't set, skip this check.)
      if (!response.getTokenProperties().getAction().equals(recaptchaAction)) {
        System.out.println(
            "The action attribute in reCAPTCHA tag is: "
                + response.getTokenProperties().getAction());
        System.out.println(
            "The action attribute in the reCAPTCHA tag "
                + "does not match the action ("
                + recaptchaAction
                + ") you are expecting to score");
        return;
      }

      // Get the reason(s) and the risk score.
      // For more information on interpreting the assessment,
      // see: https://cloud.google.com/recaptcha-enterprise/docs/interpret-assessment
      for (ClassificationReason reason : response.getRiskAnalysis().getReasonsList()) {
        System.out.println(reason);
      }

      float recaptchaScore = response.getRiskAnalysis().getScore();
      System.out.println("The reCAPTCHA score is: " + recaptchaScore);

      // Get the assessment name (id). Use this to annotate the assessment.
      String assessmentName = response.getName();
      System.out.println(
          "Assessment name: " + assessmentName.substring(assessmentName.lastIndexOf("/") + 1));
    }
  }
}

Node.js

  const {RecaptchaEnterpriseServiceClient} =
      require('@google-cloud/recaptcha-enterprise');

 /**
 * Create an assessment to analyze the risk of a UI action. Note that
 * this example does set error boundaries and returns `null` for
 * exceptions.
 *
 * projectID: Google Cloud project ID
 * recaptchaKey: reCAPTCHA key obtained by registering a domain or an app to use the services of reCAPTCHA Enterprise.
 * token: The token obtained from the client on passing the recaptchaKey.
 * recaptchaAction: Action name corresponding to the token.
 * userIpAddress: The IP address of the user sending a request to your backend is available in the HTTP request.
 * userAgent: The user agent is included in the HTTP request in the request header.
 * ja3: JA3 associated with the request.
 */
 async function createAssessment({
   projectID = "your-project-id",
   recaptchaKey = "your-recaptcha-key",
   token = "action-token",
   recaptchaAction = "action-name",
   userIpAddress = "user-ip-address",
   userAgent = "user-agent",
   ja3 = "ja3"
 }) {
   // Create the reCAPTCHA client & set the project path. There are multiple
   // ways to authenticate your client. For more information see:
   // https://cloud.google.com/docs/authentication
   // TODO: To avoid memory issues, move this client generation outside
   // of this example, and cache it (recommended) or call client.close()
   // before exiting this method.
   const client = new RecaptchaEnterpriseServiceClient();
   const projectPath = client.projectPath(projectID);

   // Build the assessment request.
   const request = ({
     assessment: {
       event: {
         token: token,
         siteKey: recaptchaKey,
         userIpAddress: userIpAddress,
         userAgent: userAgent,
         ja3: ja3,
       },
     },
     parent: projectPath,
   });

   // client.createAssessment() can return a Promise or take a Callback
   const [ response ] = await client.createAssessment(request);

   // Check if the token is valid.
   if (!response.tokenProperties.valid) {
    console.log("The CreateAssessment call failed because the token was: " +
      response.tokenProperties.invalidReason);

    return null;
   }

   // Check if the expected action was executed.
   // The `action` property is set by user client in the
   // grecaptcha.enterprise.execute() method.
   if (response.tokenProperties.action === recaptchaAction) {

    // Get the risk score and the reason(s).
    // For more information on interpreting the assessment,
    // see: https://cloud.google.com/recaptcha/docs/interpret-assessment
    console.log("The reCAPTCHA score is: " +
      response.riskAnalysis.score);

    response.riskAnalysis.reasons.forEach((reason) => {
      console.log(reason);
    });
    return response.riskAnalysis.score;
   } else {
    console.log("The action attribute in your reCAPTCHA tag " +
      "does not match the action you are expecting to score");
    return null;
   }
 }

PHP

  <?php

  // Include Google Cloud dependencies using Composer
  // composer require google/cloud-recaptcha-enterprise
  require 'vendor/autoload.php';

  use Google\Cloud\RecaptchaEnterprise\V1\RecaptchaEnterpriseServiceClient;
  use Google\Cloud\RecaptchaEnterprise\V1\Event;
  use Google\Cloud\RecaptchaEnterprise\V1\Assessment;
  use Google\Cloud\RecaptchaEnterprise\V1\TokenProperties\InvalidReason;

  /**
  * Create an assessment to analyze the risk of a UI action.
  * @param string $siteKey The key ID for the reCAPTCHA key (See https://cloud.google.com/recaptcha/docs/create-key)
  * @param string $token The user's response token for which you want to receive a reCAPTCHA score. (See https://cloud.google.com/recaptcha/docs/create-assessment#retrieve_token)
  * @param string $project Your Google Cloud project ID
  */
  function create_assessment(
     string $siteKey,
     string $token,
     string $project
  ): void {
  // TODO: To avoid memory issues, move this client generation outside
  // of this example, and cache it (recommended) or call client.close()
  // before exiting this method.
  $client = new RecaptchaEnterpriseServiceClient();
  $projectName = $client->projectName($project);

     $event = (new Event())
         ->setSiteKey($siteKey)
         ->setToken($token);

     $assessment = (new Assessment())
         ->setEvent($event);

     try {
         $response = $client->createAssessment(
             $projectName,
             $assessment
         );

         // You can use the score only if the assessment is valid,
         // In case of failures like re-submitting the same token, getValid() will return false
         if ($response->getTokenProperties()->getValid() == false) {
             printf('The CreateAssessment() call failed because the token was invalid for the following reason: ');
             printf(InvalidReason::name($response->getTokenProperties()->getInvalidReason()));
         } else {
             printf('The score for the protection action is:');
             printf($response->getRiskAnalysis()->getScore());

             // Optional: You can use the following methods to get more data about the token
             // Action name provided at token generation.
             // printf($response->getTokenProperties()->getAction() . PHP_EOL);
             // The timestamp corresponding to the generation of the token.
             // printf($response->getTokenProperties()->getCreateTime()->getSeconds() . PHP_EOL);
             // The hostname of the page on which the token was generated.
             // printf($response->getTokenProperties()->getHostname() . PHP_EOL);
         }
     } catch (exception $e) {
         printf('CreateAssessment() call failed with the following error: ');
         printf($e);
     }
  }

  // TODO(Developer): Replace the following before running the sample
  create_assessment(
     'YOUR_RECAPTCHA_KEY',
     'YOUR_USER_RESPONSE_TOKEN',
     'YOUR_GOOGLE_CLOUD_PROJECT_ID'
  );
?>

Python


from google.cloud import recaptchaenterprise_v1
from google.cloud.recaptchaenterprise_v1 import Assessment


def create_assessment(
    project_id: str,
    recaptcha_site_key: str,
    token: str,
    recaptcha_action: str,
    user_ip_address: str,
    user_agent: str,
    ja3: str,
) -> Assessment:
    """Create an assessment to analyze the risk of a UI action.
    Args:
        project_id: GCloud Project ID
        recaptcha_site_key: Site key obtained by registering a domain/app to use recaptcha services.
        token: The token obtained from the client on passing the recaptchaSiteKey.
        recaptcha_action: Action name corresponding to the token.
        user_ip_address: IP address of the user sending a request.
        user_agent: User agent is included in the HTTP request in the request header.
        ja3: JA3 associated with the request.
    """

    client = recaptchaenterprise_v1.RecaptchaEnterpriseServiceClient()

    # Set the properties of the event to be tracked.
    event = recaptchaenterprise_v1.Event()
    event.site_key = recaptcha_site_key
    event.token = token
    event.user_ip_address = user_ip_address
    event.user_agent = user_agent
    event.ja3 = ja3

    assessment = recaptchaenterprise_v1.Assessment()
    assessment.event = event

    project_name = f"projects/{project_id}"

    # Build the assessment request.
    request = recaptchaenterprise_v1.CreateAssessmentRequest()
    request.assessment = assessment
    request.parent = project_name

    response = client.create_assessment(request)

    # Check if the token is valid.
    if not response.token_properties.valid:
        print(
            "The CreateAssessment call failed because the token was "
            + "invalid for for the following reasons: "
            + str(response.token_properties.invalid_reason)
        )
        return

    # Check if the expected action was executed.
    if response.token_properties.action != recaptcha_action:
        print(
            "The action attribute in your reCAPTCHA tag does"
            + "not match the action you are expecting to score"
        )
        return
    else:
        # Get the risk score and the reason(s)
        # For more information on interpreting the assessment,
        # see: https://cloud.google.com/recaptcha-enterprise/docs/interpret-assessment
        for reason in response.risk_analysis.reasons:
            print(reason)
        print(
            "The reCAPTCHA score for this token is: "
            + str(response.risk_analysis.score)
        )
        # Get the assessment name (id). Use this to annotate the assessment.
        assessment_name = client.parse_assessment_path(response.name).get("assessment")
        print(f"Assessment name: {assessment_name}")
    return response

Ruby

require "google/cloud/recaptcha_enterprise"

# Create an assessment to analyze the risk of a UI action.
#
# @param site_key [String] Site key obtained by registering a domain/app to use recaptcha services.
# @param token [String] The token obtained from the client on passing the recaptcha site_key.
# @param project_id [String] GCloud Project ID.
# @param recaptcha_action [String] Action name corresponding to the token.
# @return [void]
def create_assessment site_key:, token:, project_id:, recaptcha_action:
  # Create the reCAPTCHA client.
  client = ::Google::Cloud::RecaptchaEnterprise.recaptcha_enterprise_service

  request = { parent: "projects/#{project_id}",
              assessment: {
                event: {
                  site_key: site_key,
                  token: token
                }
              } }

  response = client.create_assessment request

  # Check if the token is valid.
  if !response.token_properties.valid
    puts "The create_assessment() call failed because the token was invalid with the following reason:" \
         "#{response.token_properties.invalid_reason}"
  # Check if the expected action was executed.
  elsif response.token_properties.action == recaptcha_action
    # Get the risk score and the reason(s).
    # For more information on interpreting the assessment,
    # see: https://cloud.google.com/recaptcha-enterprise/docs/interpret-assessment
    puts "The reCAPTCHA score for this token is: #{response.risk_analysis.score}"
    response.risk_analysis.reasons.each { |reason| puts reason }
  else
    puts "The action attribute in your reCAPTCHA tag does not match the action you are expecting to score"
  end
end

Passaggi successivi

  • Interpreta un test e intraprendi le azioni necessarie per il tuo sito in base al punteggio.