Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Problem/Motivation
Problem 1 - Action Case
The module still doesn't work as expected without a slight work-around due to buggy code. Under "normal" conditions, v3 presents the log error: "Mismatched site and response actions." Upon saving a form, the page refreshes with errors and prompts for the fallback captcha.
The solution was found from a comment in a previous thread where @jeromebeckett mentioned his wouldn't work without the action being lowercase. https://www.drupal.org/project/recaptcha_v3/issues/3025955#comment-13385409
I can confirm this is true. The action MUST be lowercase in order to work. This is either a bug, or not documented in the action instructions. I honestly don't know how this is causing problems because the action name is lowercase in the html output. Maybe we're seeing the Mismatched site and response actions error because one is uppercase and the other is lowercase? Over my head.
Problem 2 - Action Machine Name
The next problem is that the action name can't have any spaces. Ok, the first line of the action desc says: "Action may only contain alphanumeric characters and slashes". What exactly are slashes? I tested / _ \ and they all work. Hyphens (-) do not. Clarification on "slashes" would be nice.
So if you use a "slash" in the action name, this translates to an underscore, which apparently is NOT allowed by the action despite the error: "The machine-readable name must contain only lowercase letters, numbers, and underscores."
Steps to reproduce
Case Problem
1) Create action with proper case, ex: TestAction and necessary fallback
2) Add the v3 captcha to a form
3) Test the form and look for error
4) Rename TestAction to testaction and save
5) Revisit form and try again
Action Name Problem
1) Add the action name with a forward slash (test/action) underscore (test_action) or backslash (test\action). You will see the machine name autopopulate with test_action, then try to save.
Proposed resolution
Case Resolution
The case should sanitize properly to allow both lower and uppercase characters. This is either a bug, OR this needs to be enforced to lowercase only characters.
Action Name Resolution
Something needs to be done with the machine name. By default, Drupal wants to automatically insert an underscore for odd characters like spaces, slashes etc. This either needs to be overridden to omit all underscores OR the input field needs to be limited to only allow alphanumeric characters period.
In the code, the machine name is used for: <input data-recaptcha-v3-action="highspamchance" data-recaptcha-v3-sitekey="...."> I'm assuming the data-recaptcha-v3-action can't have underscores? Then maybe allow the underscores in the machine name, but strip them on the html output? Dunno but this needs some attention to fix the bad UX around it.
Remaining tasks
Port to D8
User interface changes
API changes
Data model changes
Additional thoughts
After battling with this problem for quite some-time, we're almost there! I think a few more tweaks and it will finally be usable the way we're all expecting it to work.
| Comment | File | Size | Author |
|---|---|---|---|
| #4 | 3179324-4.patch | 3.24 KB | dench0 |
Comments
Comment #2
philsward commentedComment #3
philsward commentedOh, if it were me, (and I could program the fix...) I think the way I would approach it is to allow a true human readable name (with spaces) for the Action, then on the action form save run it through another sanitization on the machine name to remove all of the underscores. From there, the human-readable action name can be renamed all day long with whatever characters because the machine name is already good to go.
Thinking about this comment a bit more, what I'm getting at is that the Action Name should have the same feel as the rest of Drupal. This is partly where my comment about the "slashes" comes from and the reason I suggest making the Action Name a human-readable name.
Drupal has a workflow of human-readable form field that automatically generates a machine-name on the backend. I don't have to think about it, it just does it. Coming over to Recaptcha_v3, the normal Drupal feel is gone because I now have to pay attention to whether I have spaces or not in the human-readable name. I also get confused about errors coming from the underscore from the machine-name because the rest of Drupal normally thinks this is OK. I have a feeling a lot of folks who have struggled to get this going, have faced the same workflow mindset and it's been a hill to climb to get out of the Drupal way of thinking.
I would recommend that the UI is designed to follow the Drupal way of human-readable -> machine-name, then fix and obscure the necessary pieces on the backend away from the UI where it can make Google happy, but the user never has to know that lots of sanitization magic happened to pull it off. Maybe these values need to be stored elsewhere? Maybe a different DB table? Ultimately, create a front-end workflow that is normal to understand and a backend workflow that makes the whole thing come together.
Comment #4
dench0Here the patch which fixes those issues. There was bug - instead of action perviously used action machine name in the HTML markup.
This is Google requirements to the action name: check this link.
Comment #6
dench0