recaptcha 5.12.3 → 5.21.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4052ca42cf536d84329b553a058de58f2c3579e0ac2ad1e08ba42fed8ce974b4
-  data.tar.gz: 90c873c15d0772690ca3da6cf2588669a05c159e4fbaa1d6bdf5d809ad05dfd0
+  metadata.gz: f5915ff80a85bae6b80042f1d8a1d3e622470c74d8a037ebf0564260431d2030
+  data.tar.gz: c877f9e53cd0d5ba551b0bd2d5cb6e381c6baa5d7e82f8b10d9b11c0d518cd0c
 SHA512:
-  metadata.gz: 403d9de96d890bb3f75cfb83c5907f01944d8e88233248ec199fe014e04f7f1386c13cd867c9020a232cd5501faada986f6d3413d3a2369e5d38d9c56a0704b9
-  data.tar.gz: ce0d965054455acff094e60ccad808fbf836992666f9bd1233684b172e766440ba922a0f8d030803575b3a538945e3273d0ae237ce2527f9e0983b7b76671328
+  metadata.gz: 1bac93fe24a496e6d75f6515437ab3ca9c1589a1d6fbc61453833d9747910145138d00a4a8c42f648a3a46449a0dca2629333fa038689ad0e1f44a446bfd84f9
+  data.tar.gz: 95f37a636f308264a9e51ca2ca6854facd7ee0d692186272090ed60b02deccb70b00d2d9f3024dedaf040585664d688f163fa0e0ed756b36710856f7093c4d40

data/CHANGELOG.md

@@ -1,5 +1,44 @@
 ## Next
 
+## 5.21.2
+* make env fall back to Rails.env if it is unset
+
+## 5.21.1
+* Fix flash not being updated when responding to :turbo_stream requests
+
+## 5.21.0
+* add referer header to #api_verification_entreprise
+
+## 5.20.0
+* turn recpatch reply into a object with logic
+
+## 5.19.0
+* require a minimum lenght of 100 for responses, configured via response_minimum
+
+## 5.18.0
+* Add key setup to v3 example in README
+* Remove unnecessary id from textarea - This was unused and may cause accessability concerns if there is more than one recaptcha on the page due to multiple elements with the same id
+* Update to latest version of rubocop
+* Drop support for Ruby 2.7; add Ruby 3.3
+* Add i18n: de, es, it, pt, pt-BR
+* Added recaptcha_failure_reason
+
+## 5.16.0
+* Allow usage of `options[:turbo]` as well as `options[:turbolinks]` for `recaptcha_v3`
+
+## 5.15.0
+* Add 3.2 to the list of Ruby CI versions
+* Add ability to submit verify_recaptcha via POST with JSON Body with `options[:json] = true`
+
+## 5.14.0
+* drop json dependency
+
+## 5.13.1
+* Permit actions as symbol
+
+## 5.13.0
+* Added option to ignore_no_element.
+
 ## 5.12.3
 * Remove score fallback for enterprise
 * Update enterprise tests to v1 assessment schema

data/README.md

@@ -78,6 +78,10 @@ export RECAPTCHA_ENTERPRISE_API_KEY    = 'AIzvFyE3TU-g4K_Kozr9F1smEzZSGBVOfLKyup
 export RECAPTCHA_ENTERPRISE_PROJECT_ID = 'my-project'
 ```
 
+_note:_ you'll still have to provide `RECAPTCHA_SITE_KEY`, which will hold the value of your enterprise recaptcha key id. You will not need to provide a `RECAPTCHA_SECRET_KEY`, however.
+
+`RECAPTCHA_ENTERPRISE_API_KEY` is the enterprise key of your Google Cloud Project, which you can generate here: https://console.cloud.google.com/apis/credentials.
+
 Add `recaptcha_tags` to the forms you want to protect:
 
 ```erb
@@ -126,7 +130,7 @@ The following options are available:
 | `:site_key`         | Override site API key from configuration |
 | `:error`            | Override the error code returned from the reCAPTCHA API (default: `nil`) |
 | `:size`             | Specify a size (default: `nil`) |
-| `:nonce`            | Optional. Sets nonce attribute for script. Can be generated via `SecureRandom.base64(32)`. (default: `nil`) |
+| `:nonce`            | Optional. Sets nonce attribute for script. Can be generated via `SecureRandom.base64(32)`. Use `content_security_policy_nonce` if you have `config.content_security_policy_nonce_generator` set in Rails. (default: `nil`) |
 | `:id`               | Specify an html id attribute (default: `nil`) |
 | `:callback`         | Optional. Name of success callback function, executed when the user submits a successful response |
 | `:expired_callback` | Optional. Name of expiration callback function, executed when the reCAPTCHA response expires and the user needs to re-verify. |
@@ -181,6 +185,7 @@ Some of the options available:
 | `:response`               | Custom response parameter. (default: `params['g-recaptcha-response-data']`)
 | `:hostname`               | Expected hostname or a callable that validates the hostname, see [domain validation](https://developers.google.com/recaptcha/docs/domain_validation) and [hostname](https://developers.google.com/recaptcha/docs/verify#api-response) docs. (default: `nil`, but can be changed by setting `config.hostname`)
 | `:env`                    | Current environment. The request to verify will be skipped if the environment is specified in configuration under `skip_verify_env`
+| `:json`                   | Boolean; defaults to false; if true, will submit the verification request by POST with the request data in JSON
 
 
 ### `invisible_recaptcha_tags`
@@ -203,7 +208,7 @@ It also accepts most of the options that `recaptcha_tags` accepts, including the
 | Option              | Description |
 |---------------------|-------------|
 | `:site_key`         | Override site API key from configuration |
-| `:nonce`            | Optional. Sets nonce attribute for script tag. Can be generated via `SecureRandom.base64(32)`. (default: `nil`) |
+| `:nonce`            | Optional. Sets nonce attribute for script tag. Can be generated via `SecureRandom.base64(32)`. Use `content_security_policy_nonce` if you have `config.content_security_policy_nonce_generator` set in Rails. (default: `nil`) |
 | `:id`               | Specify an html id attribute (default: `nil`) |
 | `:script`           | Same as setting both `:inline_script` and `:external_script`. If you only need one or the other, use `:inline_script` and `:external_script` instead. |
 | `:callback`         | Optional. Name of success callback function, executed when the user submits a successful response |
@@ -304,6 +309,14 @@ With v3, you can let all users log in without any intervention at all if their s
 threshold, and only show a v2 checkbox recaptcha challenge (fall back to v2) if it is below the
 threshold:
 
+This example sets v2 keys through environment variables. For more information on how to set up keys, please refer to the [documentation here](#alternative-api-key-setup).
+
+```bash
+# .env
+RECAPTCHA_SITE_KEY=6Lc6BAAAAAAAAChqRbQZcn_yyyyyyyyyyyyyyyyy
+RECAPTCHA_SECRET_KEY=6Lc6BAAAAAAAAKN3DRm6VA_xxxxxxxxxxxxxxxxx
+```
+
 ```erb
   …
   <% if @show_checkbox_recaptcha %>
@@ -418,15 +431,17 @@ but only accepts the following options:
 | Option              | Description |
 |---------------------|-------------|
 | `:site_key`         | Override site API key |
-| `:action`           | The name of the [reCAPTCHA action](https://developers.google.com/recaptcha/docs/v3#actions). Actions may only contain alphanumeric characters and slashes, and must not be user-specific. |
-| `:nonce`            | Optional. Sets nonce attribute for script. Can be generated via `SecureRandom.base64(32)`. (default: `nil`) |
+| `:action`           | The name of the [reCAPTCHA action](https://developers.google.com/recaptcha/docs/v3#actions). Actions are not case-sensitive and may only contain alphanumeric characters, slashes, and underscores, and must not be user-specific. |
+| `:nonce`            | Optional. Sets nonce attribute for script. Can be generated via `SecureRandom.base64(32)`. Use `content_security_policy_nonce` if you have `config.content_security_policy_nonce_generator` set in Rails. (default: `nil`) |
 | `:callback`         | Name of callback function to call with the token. When `element` is `:input`, this defaults to a function named `setInputWithRecaptchaResponseTokenFor#{sanitize_action(action)}` that sets the value of the hidden input to the token. |
 | `:id`               | Specify a unique `id` attribute for the `<input>` element if using `element: :input`. (default: `"g-recaptcha-response-data-"` + `action`) |
 | `:name`             | Specify a unique `name` attribute for the `<input>` element if using `element: :input`. (default: `g-recaptcha-response-data[action]`) |
 | `:script`           | Same as setting both `:inline_script` and `:external_script`. (default: `true`). |
 | `:inline_script`    | If `true`, adds an inline script tag that calls `grecaptcha.execute` for the given `site_key` and `action` and calls the `callback` with the resulting response token. Pass `false` if you want to handle calling `grecaptcha.execute` yourself. (default: `true`) |
 | `:element`          | The element to render, if any (default: `:input`)<br/>`:input`: Renders a hidden `<input type="hidden">` tag. The value of this will be set to the response token by the default `setInputWithRecaptchaResponseTokenFor{action}` callback.<br/>`false`: Doesn't render any tag. You'll have to add a custom callback that does something with the token. |
-| `:turbolinks`          | If `true`, calls the js function which executes reCAPTCHA after all the dependencies have been loaded. This cannot be used with the js param `:onload`. This makes reCAPTCHAv3 usable with turbolinks. |
+| `:turbo`              | If `true`, calls the js function which executes reCAPTCHA after all the dependencies have been loaded. This cannot be used with the js param `:onload`. This makes reCAPTCHAv3 usable with turbo. |
+| `:turbolinks`         | Alias of `:turbo`. Will be deprecated soon. |
+| `:ignore_no_element`  | If `true`, adds null element checker for forms that can be removed from the page by javascript like modals with forms. (default: true) |
 
 [JavaScript resource (api.js) parameters](https://developers.google.com/recaptcha/docs/invisible#js_param):
 
@@ -473,7 +488,7 @@ are passed as a hash under `params['g-recaptcha-response-data']` with the action
 It is recommended to pass `external_script: false` on all but one of the calls to
 `recaptcha` since you only need to include the script tag once for a given `site_key`.
 
-## `recaptcha_reply`
+## `recaptcha_reply` and `recaptcha_failure_reason`
 
 After `verify_recaptcha` has been called, you can call `recaptcha_reply` to get the raw reply from recaptcha. This can allow you to get the exact score returned by recaptcha should you need it.
 
@@ -489,6 +504,8 @@ end
 
 `recaptcha_reply` will return `nil` if the the reply was not yet fetched.
 
+`recaptcha_failure_reason` will return information if verification failed. E.g. if params was wrong or api resulted some error-codes.
+
 ## I18n support
 
 reCAPTCHA supports the I18n gem (it comes with English translations)
@@ -572,6 +589,7 @@ Recaptcha.configure do |config|
   config.verify_url = 'https://hcaptcha.com/siteverify'
   config.api_server_url = 'https://hcaptcha.com/1/api.js'
   config.response_limit = 100000
+  config.response_minimum = 100
 end
 ```
 

data/lib/recaptcha/adapters/controller_methods.rb

@@ -17,6 +17,11 @@ module Recaptcha
 
         begin
           verified = if Recaptcha.invalid_response?(recaptcha_response)
+            @_recaptcha_failure_reason = if recaptcha_response.nil?
+              "No recaptcha response/param(:action) found."
+            else
+              "Recaptcha response/param(:action) was invalid."
+            end
             false
           else
             unless options[:skip_remote_ip]
@@ -26,10 +31,23 @@ module Recaptcha
 
             success, @_recaptcha_reply =
               Recaptcha.verify_via_api_call(recaptcha_response, options.merge(with_reply: true))
+
+            unless success
+              @_recaptcha_failure_reason =
+                if @_recaptcha_reply.score && @_recaptcha_reply.score.to_f < options[:minimum_score].to_f
+                  "Recaptcha score didn't exceed the minimum: #{@_recaptcha_reply.score} < #{options[:minimum_score]}."
+                elsif @_recaptcha_reply.error_codes.any?
+                  "Recaptcha api call returned with error-codes: #{@_recaptcha_reply.error_codes}."
+                else
+                  "Recaptcha failure after api call. Api reply: #{@_recaptcha_reply}."
+                end
+            end
+
             success
           end
 
           if verified
+            @_recaptcha_failure_reason = nil
             flash.delete(:recaptcha_error) if recaptcha_flash_supported? && !model
             true
           else
@@ -41,6 +59,7 @@ module Recaptcha
             false
           end
         rescue Timeout::Error
+          @_recaptcha_failure_reason = "Recaptcha server unreachable."
           if Recaptcha.configuration.handle_timeouts_gracefully
             recaptcha_error(
               model,
@@ -57,13 +76,17 @@ module Recaptcha
       end
 
       def verify_recaptcha!(options = {})
-        verify_recaptcha(options) || raise(VerifyError)
+        verify_recaptcha(options) || raise(VerifyError, @_recaptcha_failure_reason)
       end
 
       def recaptcha_reply
         @_recaptcha_reply if defined?(@_recaptcha_reply)
       end
 
+      def recaptcha_failure_reason
+        @_recaptcha_failure_reason
+      end
+
       def recaptcha_error(model, attribute, message)
         if model
           model.errors.add(attribute, message)
@@ -73,7 +96,9 @@ module Recaptcha
       end
 
       def recaptcha_flash_supported?
-        request.respond_to?(:format) && request.format == :html && respond_to?(:flash)
+        request.respond_to?(:format) && respond_to?(:flash) && (
+          request.format == :html || request.format == :turbo_stream
+        )
       end
 
       # Extracts response token from params. params['g-recaptcha-response-data'] for recaptcha_v3 or

data/lib/recaptcha/configuration.rb

@@ -37,8 +37,10 @@ module Recaptcha
       'enterprise_verify_url' => 'https://recaptchaenterprise.googleapis.com/v1/projects'
     }.freeze
 
-    attr_accessor :default_env, :skip_verify_env, :proxy, :secret_key, :site_key, :handle_timeouts_gracefully,
-                  :hostname, :enterprise, :enterprise_api_key, :enterprise_project_id, :response_limit
+    attr_accessor(
+      :default_env, :skip_verify_env, :proxy, :secret_key, :site_key, :handle_timeouts_gracefully,
+      :hostname, :enterprise, :enterprise_api_key, :enterprise_project_id, :response_limit, :response_minimum
+    )
     attr_writer :api_server_url, :verify_url
 
     def initialize # :nodoc:
@@ -57,6 +59,7 @@ module Recaptcha
       @api_server_url = nil
 
       @response_limit = 4000
+      @response_minimum = 100
     end
 
     def secret_key!

data/lib/recaptcha/helpers.rb

@@ -12,10 +12,11 @@ module Recaptcha
       action = options.delete(:action) || raise(Recaptcha::RecaptchaError, 'action is required')
       id = options.delete(:id) || "g-recaptcha-response-data-#{dasherize_action(action)}"
       name = options.delete(:name) || "g-recaptcha-response-data[#{action}]"
-      turbolinks = options.delete(:turbolinks)
+      turbo = options.delete(:turbo) || options.delete(:turbolinks)
       options[:render] = site_key
       options[:script_async] ||= false
       options[:script_defer] ||= false
+      options[:ignore_no_element] = options.key?(:ignore_no_element) ? options[:ignore_no_element] : true
       element = options.delete(:element)
       element = element == false ? false : :input
       if element == :input
@@ -23,11 +24,11 @@ module Recaptcha
       end
       options[:class] = "g-recaptcha-response #{options[:class]}"
 
-      if turbolinks
+      if turbo
         options[:onload] = recaptcha_v3_execute_function_name(action)
       end
       html, tag_attributes = components(options)
-      if turbolinks
+      if turbo
         html << recaptcha_v3_onload_script(site_key, action, callback, id, options)
       elsif recaptcha_v3_inline_script?(options)
         html << recaptcha_v3_inline_script(site_key, action, callback, id, options)
@@ -73,7 +74,7 @@ module Recaptcha
               <div style="width: 300px; height: 60px; border-style: none;
                 bottom: 12px; left: 25px; margin: 0px; padding: 0px; right: 25px;
                 background: #f9f9f9; border: 1px solid #c1c1c1; border-radius: 3px;">
-                <textarea id="g-recaptcha-response" name="g-recaptcha-response"
+                <textarea name="g-recaptcha-response"
                   class="g-recaptcha-response"
                   style="width: 250px; height: 40px; border: 1px solid #c1c1c1;
                   margin: 10px 25px; padding: 0px; resize: none;">
@@ -138,6 +139,8 @@ module Recaptcha
       nonce = options.delete(:nonce)
       skip_script = (options.delete(:script) == false) || (options.delete(:external_script) == false)
       ui = options.delete(:ui)
+      options.delete(:ignore_no_element)
+      options.delete(:inline_script)
 
       data_attribute_keys = [:badge, :theme, :type, :callback, :expired_callback, :error_callback, :size]
       data_attribute_keys << :tabindex unless ui == :button
@@ -206,7 +209,7 @@ module Recaptcha
             })
           };
 
-          #{recaptcha_v3_define_default_callback(callback) if recaptcha_v3_define_default_callback?(callback, action, options)}
+          #{recaptcha_v3_define_default_callback(callback, options) if recaptcha_v3_define_default_callback?(callback, action, options)}
         </script>
       HTML
     end
@@ -224,7 +227,7 @@ module Recaptcha
               });
             });
           };
-          #{recaptcha_v3_define_default_callback(callback) if recaptcha_v3_define_default_callback?(callback, action, options)}
+          #{recaptcha_v3_define_default_callback(callback, options) if recaptcha_v3_define_default_callback?(callback, action, options)}
         </script>
       HTML
     end
@@ -235,12 +238,12 @@ module Recaptcha
       options[:inline_script] != false
     end
 
-    private_class_method def self.recaptcha_v3_define_default_callback(callback)
+    private_class_method def self.recaptcha_v3_define_default_callback(callback, options)
       <<-HTML
-          var #{callback} = function(id, token) {
-            var element = document.getElementById(id);
-            element.value = token;
-          }
+        var #{callback} = function(id, token) {
+          var element = document.getElementById(id);
+          #{element_check_condition(options)} element.value = token;
+        }
       HTML
     end
 
@@ -328,5 +331,9 @@ module Recaptcha
     private_class_method def self.hash_to_query(hash)
       hash.delete_if { |_, val| val.nil? || val.empty? }.to_a.map { |pair| pair.join('=') }.join('&')
     end
+
+    private_class_method def self.element_check_condition(options)
+      options[:ignore_no_element] ? "if (element !== null)" : ""
+    end
   end
 end

data/lib/recaptcha/reply.rb

@@ -0,0 +1,118 @@
+# frozen_string_literal: true
+
+module Recaptcha
+  class Reply
+    def initialize(raw_reply, enterprise:)
+      @raw_reply = raw_reply
+      @enterprise = enterprise
+    end
+
+    def [](key)
+      @raw_reply[key.to_s]
+    end
+
+    def success?(options = {})
+      success.to_s == 'true' &&
+        hostname_valid?(options[:hostname]) &&
+        action_valid?(options[:action]) &&
+        score_above_threshold?(options[:minimum_score]) &&
+        score_below_threshold?(options[:maximum_score])
+    end
+
+    def token_properties
+      @raw_reply['tokenProperties'] if enterprise?
+    end
+
+    def success
+      if enterprise?
+        token_properties&.dig('valid')
+      else
+        @raw_reply['success']
+      end
+    end
+
+    def hostname
+      if enterprise?
+        token_properties&.dig('hostname')
+      else
+        @raw_reply['hostname']
+      end
+    end
+
+    def action
+      if enterprise?
+        token_properties&.dig('action')
+      else
+        @raw_reply['action']
+      end
+    end
+
+    def score
+      if enterprise?
+        @raw_reply.dig('riskAnalysis', 'score')
+      else
+        @raw_reply['score'] unless enterprise?
+      end
+    end
+
+    def error_codes
+      if enterprise?
+        []
+      else
+        @raw_reply['error-codes'] || []
+      end
+    end
+
+    def challenge_ts
+      return @raw_reply['challenge_ts'] unless enterprise?
+
+      token_properties&.dig('createTime')
+    end
+
+    def hostname_valid?(validation)
+      validation ||= Recaptcha.configuration.hostname
+
+      case validation
+      when nil, FalseClass
+        true
+      when String
+        validation == hostname
+      else
+        validation.call(hostname)
+      end
+    end
+
+    def action_valid?(expected_action)
+      case expected_action
+      when nil, FalseClass
+        true
+      else
+        action == expected_action.to_s
+      end
+    end
+
+    def score_above_threshold?(minimum_score)
+      !minimum_score || (score && score >= minimum_score)
+    end
+
+    def score_below_threshold?(maximum_score)
+      !maximum_score || (score && score <= maximum_score)
+    end
+
+    def enterprise?
+      @enterprise
+    end
+
+    def to_h
+      @raw_reply
+    end
+
+    def to_s
+      @raw_reply.to_s
+    end
+
+    def to_json(*args)
+      @raw_reply.to_json(*args)
+    end
+  end
+end

data/lib/recaptcha/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Recaptcha
-  VERSION = '5.12.3'
+  VERSION = '5.21.2'
 end

data/lib/recaptcha.rb

@@ -6,6 +6,7 @@ require 'uri'
 
 require 'recaptcha/configuration'
 require 'recaptcha/helpers'
+require 'recaptcha/reply'
 require 'recaptcha/adapters/controller_methods'
 require 'recaptcha/adapters/view_methods'
 if defined?(Rails)
@@ -51,11 +52,13 @@ module Recaptcha
   end
 
   def self.skip_env?(env)
-    configuration.skip_verify_env.include?(env || configuration.default_env)
+    resolved = env || configuration.default_env ||
+      (defined?(Rails.env) && Rails.env.to_s) # default_env is sometimes not set during initialization
+    configuration.skip_verify_env.include?(resolved)
   end
 
   def self.invalid_response?(resp)
-    resp.empty? || resp.length > configuration.response_limit
+    resp.empty? || resp.length > configuration.response_limit || resp.length < configuration.response_minimum
   end
 
   def self.verify_via_api_call(response, options)
@@ -76,21 +79,10 @@ module Recaptcha
     body['event']['expectedAction'] = options[:action] if options.key?(:action)
     body['event']['userIpAddress'] = options[:remote_ip] if options.key?(:remote_ip)
 
-    reply = api_verification_enterprise(query_params, body, project_id, timeout: options[:timeout])
-    score = reply.dig('riskAnalysis', 'score')
-    token_properties = reply['tokenProperties']
-    success = !token_properties.nil? &&
-      token_properties['valid'].to_s == 'true' &&
-      hostname_valid?(token_properties['hostname'], options[:hostname]) &&
-      action_valid?(token_properties['action'], options[:action]) &&
-      score_above_threshold?(score, options[:minimum_score]) &&
-      score_below_threshold?(score, options[:maximum_score])
-
-    if options[:with_reply] == true
-      [success, reply]
-    else
-      success
-    end
+    raw_reply = api_verification_enterprise(query_params, body, project_id, timeout: options[:timeout])
+    reply = Reply.new(raw_reply, enterprise: true)
+    result = reply.success?(options)
+    options[:with_reply] == true ? [result, reply] : result
   end
 
   def self.verify_via_api_call_free(response, options)
@@ -98,43 +90,10 @@ module Recaptcha
     verify_hash = { 'secret' => secret_key, 'response' => response }
     verify_hash['remoteip'] = options[:remote_ip] if options.key?(:remote_ip)
 
-    reply = api_verification_free(verify_hash, timeout: options[:timeout])
-    success = reply['success'].to_s == 'true' &&
-      hostname_valid?(reply['hostname'], options[:hostname]) &&
-      action_valid?(reply['action'], options[:action]) &&
-      score_above_threshold?(reply['score'], options[:minimum_score]) &&
-      score_below_threshold?(reply['score'], options[:maximum_score])
-
-    if options[:with_reply] == true
-      [success, reply]
-    else
-      success
-    end
-  end
-
-  def self.hostname_valid?(hostname, validation)
-    validation ||= configuration.hostname
-
-    case validation
-    when nil, FalseClass then true
-    when String then validation == hostname
-    else validation.call(hostname)
-    end
-  end
-
-  def self.action_valid?(action, expected_action)
-    case expected_action
-    when nil, FalseClass then true
-    else action == expected_action
-    end
-  end
-
-  def self.score_above_threshold?(score, minimum_score)
-    !minimum_score || (score && score >= minimum_score)
-  end
-
-  def self.score_below_threshold?(score, maximum_score)
-    !maximum_score || (score && score <= maximum_score)
+    raw_reply = api_verification_free(verify_hash, timeout: options[:timeout], json: options[:json])
+    reply = Reply.new(raw_reply, enterprise: false)
+    result = reply.success?(options)
+    options[:with_reply] == true ? [result, reply] : result
   end
 
   def self.http_client_for(uri:, timeout: nil)
@@ -152,11 +111,18 @@ module Recaptcha
     instance
   end
 
-  def self.api_verification_free(verify_hash, timeout: nil)
-    query = URI.encode_www_form(verify_hash)
-    uri = URI.parse("#{configuration.verify_url}?#{query}")
+  def self.api_verification_free(verify_hash, timeout: nil, json: false)
+    if json
+      uri = URI.parse(configuration.verify_url)
+      request = Net::HTTP::Post.new(uri.request_uri)
+      request['Content-Type'] = 'application/json; charset=utf-8'
+      request.body = JSON.generate(verify_hash)
+    else
+      query = URI.encode_www_form(verify_hash)
+      uri = URI.parse("#{configuration.verify_url}?#{query}")
+      request = Net::HTTP::Get.new(uri.request_uri)
+    end
     http_instance = http_client_for(uri: uri, timeout: timeout)
-    request = Net::HTTP::Get.new(uri.request_uri)
     JSON.parse(http_instance.request(request).body)
   end
 
@@ -165,6 +131,7 @@ module Recaptcha
     uri = URI.parse("#{configuration.verify_url}/#{project_id}/assessments?#{query}")
     http_instance = http_client_for(uri: uri, timeout: timeout)
     request = Net::HTTP::Post.new(uri.request_uri)
+    request['Referer'] = Rails.application.default_url_options[:host] if defined? Rails.application
     request['Content-Type'] = 'application/json; charset=utf-8'
     request.body = JSON.generate(body)
     JSON.parse(http_instance.request(request).body)

data/rails/locales/de.yml

@@ -0,0 +1,5 @@
+de:
+  recaptcha:
+    errors:
+      verification_failed: Die reCAPTCHA-Überprüfung ist fehlgeschlagen, bitte versuchen Sie es erneut.
+      recaptcha_unreachable: Oops, wir konnten Ihre reCAPTCHA-Antwort nicht validieren. Bitte versuchen Sie es erneut.

data/rails/locales/es.yml

@@ -0,0 +1,5 @@
+es:
+  recaptcha:
+    errors:
+      verification_failed: La verificación de reCAPTCHA falló, por favor intente de nuevo.
+      recaptcha_unreachable: Ups, no pudimos validar su respuesta de reCAPTCHA. Por favor intente de nuevo.

data/rails/locales/it.yml

@@ -0,0 +1,5 @@
+it:
+  recaptcha:
+    errors:
+      verification_failed: La verifica reCAPTCHA non è riuscita, si prega di riprovare.
+      recaptcha_unreachable: Ops, non siamo riusciti a convalidare la tua risposta reCAPTCHA. Per favore riprova.

data/rails/locales/pt-BR.yml

@@ -0,0 +1,5 @@
+pt-BR:
+  recaptcha:
+    errors:
+      verification_failed: A verificação do reCAPTCHA falhou, por favor, tente novamente.
+      recaptcha_unreachable: Oops, não conseguimos validar sua resposta do reCAPTCHA. Por favor, tente novamente.

data/rails/locales/pt.yml

@@ -0,0 +1,5 @@
+pt:
+  recaptcha:
+    errors:
+      verification_failed: A verificação do reCAPTCHA falhou, por favor, tente novamente.
+      recaptcha_unreachable: Oops, não conseguimos validar sua resposta do reCAPTCHA. Por favor, tente novamente.

metadata

@@ -1,29 +1,15 @@
 --- !ruby/object:Gem::Specification
 name: recaptcha
 version: !ruby/object:Gem::Version
-  version: 5.12.3
+  version: 5.21.2
 platform: ruby
 authors:
 - Jason L Perry
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-09-05 00:00:00.000000000 Z
+date: 2026-04-09 00:00:00.000000000 Z
 dependencies:
-- !ruby/object:Gem::Dependency
-  name: json
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 - !ruby/object:Gem::Dependency
   name: mocha
   requirement: !ruby/object:Gem::Requirement
@@ -153,16 +139,23 @@ files:
 - lib/recaptcha/helpers.rb
 - lib/recaptcha/rails.rb
 - lib/recaptcha/railtie.rb
+- lib/recaptcha/reply.rb
 - lib/recaptcha/version.rb
+- rails/locales/de.yml
 - rails/locales/en.yml
+- rails/locales/es.yml
 - rails/locales/fr.yml
+- rails/locales/it.yml
 - rails/locales/ja.yml
 - rails/locales/nl.yml
+- rails/locales/pt-BR.yml
+- rails/locales/pt.yml
 homepage: http://github.com/ambethia/recaptcha
 licenses:
 - MIT
 metadata:
   source_code_uri: https://github.com/ambethia/recaptcha
+  rubygems_mfa_required: 'true'
 post_install_message:
 rdoc_options: []
 require_paths:
@@ -171,14 +164,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.7.0
+      version: 3.0.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.3
+rubygems_version: 3.4.10
 signing_key:
 specification_version: 4
 summary: Helpers for the reCAPTCHA API