Android Question How use recaptcha google in app

[Pooya1]

Hi
I could use Google's recaptcha in my website
Now i need use it in app
I searched about it in android
I have to use safetynet in b4a
Please help me

 

[Erel]

I will try to write an example next week.

 

[KMatle]

Nice! Ehm, does that really make sense? Rather for "robot farms" with unrooted devices or so than for regular users.

 

[Erel]

1. Sign for this service: https://developer.android.com/training/safetynet/recaptcha
You need to get a site key and secret key.
The site key is used in the Android app and the secret key is used on the server.

2. Add:

#AdditionalJar: com.google.android.gms:play-services-safetynet

3. Add in manifest editor:

CreateResourceFromFile(Macro, FirebaseAnalytics.GooglePlayBase)

4. Call verify in your activity:

'RecaptchaKey is a process global string.
Sub Verify
   Dim ctxt As JavaObject
   ctxt.InitializeContext
   Dim Client As JavaObject
   Client = Client.InitializeStatic("com/google/android/gms/safetynet.SafetyNet".Replace("/", ".")).RunMethod("getClient", Array(ctxt))
   Dim task As JavaObject = Client.RunMethod("verifyWithRecaptcha", Array(RecaptchaKey))
   Dim start As Long = DateTime.Now
   Do While task.RunMethod("isComplete", Null) = False And start + 10000 > DateTime.Now
       Sleep(100)
   Loop
   If task.RunMethod("isSuccessful", Null) Then
       Dim token As JavaObject = task.RunMethod("getResult", Null)
       Dim tokenkey As String = token.RunMethod("getTokenResult", Null)
       Log(tokenkey)
       VerifyToken(tokenkey)  '<---the token should be sent to your server and the server should verify the token
   Else
       Log("error")
   End If
End Sub

5. Verify token on the server:

'ServerSecretKey is a process global string.
Sub VerifyToken(token As String)
   'verify the token
   Dim j As HttpJob
   j.Initialize("", Me)
   j.PostString("https://www.google.com/recaptcha/api/siteverify", $"secret=${ServerSecretKey}&response=${token}"$)
   Wait For (j) JobDone (j As HttpJob)
   If j.Success Then
       Dim parser As JSONParser
       parser.Initialize(j.GetString)
       Dim m As Map = parser.NextObject
       Dim success As Boolean = m.Get("success")
       If success Then
           Log("User verified!!!!")
       Else
           Log("error!!!")
       End If
   End If
   j.Release
End Sub

Note that this code will only work in portrait mode. It will require some changes to work in landscape.

The server step can technically be done from the mobile app, however it is less secure.

 

[Erel]

Screenshot:

 

[Pooya1]

Screenshot:

Thank you so much
I have question
Is it good for security of app and server?

 

[Erel]

Security is a large and complex topic. You must provide more information if you want to get meaningful answers.

 

[Pooya1]

Sorry for open this post
I use your sample but i have error Generating R file. Error
I updated SDK completely

 

[Erel]

Please upload a small project with your code.

 

[Pooya1]

Please upload a small project with your code.

 

[Erel]

Why are you using HttpUtils2 instead of OkHttpUtils2?

Compiles fine here.

 

[Hamied Abou Hulaikah]

'RecaptchaKey is a process global string.
Sub Verify
   Dim ctxt As JavaObject
   ctxt.InitializeContext
   Dim Client As JavaObject
   Client = Client.InitializeStatic("com/google/android/gms/safetynet.SafetyNet".Replace("/", ".")).RunMethod("getClient", Array(ctxt))
   Dim task As JavaObject = Client.RunMethod("verifyWithRecaptcha", Array(RecaptchaKey))
   Dim start As Long = DateTime.Now
   Do While task.RunMethod("isComplete", Null) = False And start + 10000 > DateTime.Now
       Sleep(100)
   Loop
   If task.RunMethod("isSuccessful", Null) Then
       Dim token As JavaObject = task.RunMethod("getResult", Null)
       Dim tokenkey As String = token.RunMethod("getTokenResult", Null)
       Log(tokenkey)
       VerifyToken(tokenkey)  '<---the token should be sent to your server and the server should verify the token
   Else
       Log("error")
   End If
End Sub

I got "error"; that is meaning task.RunMethod("isSuccessful", Null) is false!!! Why?
I used mine RecaptchaKey

 

[Erel]

Hard to say. Check the logs there might be more information there. Do you see the recaptcha form?

 

[Hamied Abou Hulaikah]

Do you see the recaptcha form?

Yes i see it, but small square with loading animated circle only, no pictures puzzle or any security question!

 

[Erel]

Can you upload the project?

 

[Hamied Abou Hulaikah]

This my project attached

 

[Erel]

It started working after I changed the recaptcha key and package name.

 

[Hamied Abou Hulaikah]

It started working after I changed the recaptcha key and package name.

What recaptcha key you used? v2 or v3?
and
Is package name matter?

 

[Hamied Abou Hulaikah]

Oh
Sorry
Solved
The problem is by mistake i wrote website name in package name field in google recaptcha registration

Sorry @Erel for taking your time

 

[alimanam3386]

4. Call verify in your activity:

'RecaptchaKey is a process global string.
Sub Verify
   Dim ctxt As JavaObject
   ctxt.InitializeContext
   Dim Client As JavaObject
   Client = Client.InitializeStatic("com/google/android/gms/safetynet.SafetyNet".Replace("/", ".")).RunMethod("getClient", Array(ctxt))
   Dim task As JavaObject = Client.RunMethod("verifyWithRecaptcha", Array(RecaptchaKey))
   Dim start As Long = DateTime.Now
   Do While task.RunMethod("isComplete", Null) = False And start + 10000 > DateTime.Now
       Sleep(100)
   Loop
   If task.RunMethod("isSuccessful", Null) Then
       Dim token As JavaObject = task.RunMethod("getResult", Null)
       Dim tokenkey As String = token.RunMethod("getTokenResult", Null)
       Log(tokenkey)
       VerifyToken(tokenkey)  '<---the token should be sent to your server and the server should verify the token
   Else
       Log("error")
   End If
End Sub

in server side ( java script ) I got this error after verification of token :

"error": {
        "success": false,
        "error-codes": [
            "timeout-or-duplicate"
        ]
    }

so , How can I rest the token ( get new token ) like use in a browser ( refresh page) ?