Client Server REST API captcha implementation

Issue

I'm building client server REST application. Client side is based on Angular while server is PHP (not that it matters much anyhow).

What I am wondering if there are any best practices, good examples of captcha implementation in this case? Captcha would be used for user registration etc.

I'm not limited to any specific libraries, only requirement is that there cannot be any calls to 3rd party servers on client side (js libraries hosted on 3rd party servers or req api key etc).

thanks

Solution

When google captcha approves one user, it provides you a token.

So imagine this scenario. A User is about to save, and uses the captcha, the captcha does its business and gives you a token, it is all that matters.

If you want to see a "tentative" flow of requests for this.

1. The User should pass the captcha before registering and retrieve the token that it provides in the front end.
2. User clicks save, you receive the captcha token in the backend as form data. You validate the token with Google via an API. If Google verifies the token as valid, you can save the user or reject if Google returns an error.
3. The frontend listens for success or error and what kind of error. IF error is captcha, force a retry, get a new token.
4. Backend receives a new token in form data and repeats step 2.

Answered By - Daniel Aranda