ai_ml_operations/chat_web_app
2
0 Fork 0
Code Issues 19 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Use reCAPTCHA v3 on password reset #135

Merged
westfarn merged 1 commits from fix/134-recaptcha-v3 into master 2026-10-23 03:51:15 -07:00
Conversation 0 Commits 1 Files Changed 6
+154 -78
westfarn commented 2026-10-23 03:46:16 -07:00
Owner
Copy link
Copy source

Summary

  • Closes #134.
  • Password reset loads reCAPTCHA v3 and sends grecaptcha.execute(siteKey, { action: 'password_reset' }) as recaptchaToken.
  • Removes react-google-recaptcha. That package is a v2 widget, and the Hesychia key is v3, so Google rejected the site key on https://hesychia.ai/password_reset/ before submit.
  • Site key stays 6LfENu4qAAAAAFtPejcrP3dwBDxcRPjqi7RhytJJ. The backend already checks the v3 token with CAPTCHA_SECRET_KEY and rejects a score under 0.5.

Test plan

  • CI=true npm test -- --watchAll=false --coverage=false --testPathPattern=pages/PasswordReset (6 passed)
  • After deploy, open https://hesychia.ai/password_reset/ and confirm the invalid reCAPTCHA error is gone
  • Submit a real account email and confirm the reset email sends
  • Submit again with a bad or blocked client and confirm the page shows "Unable to reset password"
## Summary - Closes #134. - Password reset loads reCAPTCHA v3 and sends `grecaptcha.execute(siteKey, { action: 'password_reset' })` as `recaptchaToken`. - Removes `react-google-recaptcha`. That package is a v2 widget, and the Hesychia key is v3, so Google rejected the site key on https://hesychia.ai/password_reset/ before submit. - Site key stays `6LfENu4qAAAAAFtPejcrP3dwBDxcRPjqi7RhytJJ`. The backend already checks the v3 token with `CAPTCHA_SECRET_KEY` and rejects a score under 0.5. ## Test plan - [x] `CI=true npm test -- --watchAll=false --coverage=false --testPathPattern=pages/PasswordReset` (6 passed) - [ ] After deploy, open https://hesychia.ai/password_reset/ and confirm the invalid reCAPTCHA error is gone - [ ] Submit a real account email and confirm the reset email sends - [ ] Submit again with a bad or blocked client and confirm the page shows "Unable to reset password"
westfarn added 1 commit 2026-10-23 03:46:16 -07:00
Use reCAPTCHA v3 on password reset.
Unit Tests / test (pull_request) Successful in 36s
Details
81b436873b 
The Hesychia key is v3. The v2 invisible widget rejected that site key on load.
Closes #134.
westfarn merged commit 6b6df4247f into master 2026-10-23 03:51:15 -07:00
westfarn deleted branch fix/134-recaptcha-v3 2026-10-23 03:51:16 -07:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
twestfall westfarn (Ryan Westfall)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: ai_ml_operations/chat_web_app#135