Password reset: call reCAPTCHA v3 instead of the v2 widget #134

New Issue

2026-10-23T03:42:19-07:00

westfarn commented

2026-10-23 03:42:19 -07:00

Problem

https://hesychia.ai/password_reset/ shows an invalid reCAPTCHA error on load.

The Google key for Hesychia is reCAPTCHA v3, and CAPTCHA_SECRET_KEY is already set for that key. hesychia.ai is already on the key's domain list.

The page still mounts react-google-recaptcha with size="invisible". That package is a v2 widget. Google rejects a v3 site key in a v2 widget before the form is submitted.

Fix

Load reCAPTCHA v3 (api.js?render=SITE_KEY) and send grecaptcha.execute(siteKey, { action: 'password_reset' }) as recaptchaToken.

The backend already verifies v3 tokens and rejects a score under 0.5. No backend change.

Site key stays 6LfENu4qAAAAAFtPejcrP3dwBDxcRPjqi7RhytJJ, the pair of the secret already in the secrets file.

## Problem https://hesychia.ai/password_reset/ shows an invalid reCAPTCHA error on load. The Google key for Hesychia is reCAPTCHA v3, and `CAPTCHA_SECRET_KEY` is already set for that key. `hesychia.ai` is already on the key's domain list. The page still mounts `react-google-recaptcha` with `size="invisible"`. That package is a v2 widget. Google rejects a v3 site key in a v2 widget before the form is submitted. ## Fix Load reCAPTCHA v3 (`api.js?render=SITE_KEY`) and send `grecaptcha.execute(siteKey, { action: 'password_reset' })` as `recaptchaToken`. The backend already verifies v3 tokens and rejects a score under 0.5. No backend change. Site key stays `6LfENu4qAAAAAFtPejcrP3dwBDxcRPjqi7RhytJJ`, the pair of the secret already in the secrets file.

westfarn referenced this issue from a commit

2026-10-23 03:46:10 -07:00

Use reCAPTCHA v3 on password reset.

westfarn referenced a pull request that will close this issue

2026-10-23 03:46:16 -07:00

Use reCAPTCHA v3 on password reset #135

westfarn closed this issue

2026-10-23 03:51:16 -07:00

westfarn referenced this issue from a commit

2026-10-23 03:51:16 -07:00

Use reCAPTCHA v3 on password reset (#135)

Sign in to join this conversation.