ReCaptcha is useless

[JakeRobinson456]

That ReCaptcha is useless because it is only being checked on the client side.

Anybody can bypass the captcha with just a little skill in programming.

Or am I missing something?

[kevinfaveri]

it is not. Please read the README.md instructions, but TLDR is https://github.com/kevinfaveri/solana-candy-factory/blob/main/src/pages/api/validate-captcha.ts validates the captcha server side. This is a partial anti bot solution, because the best thing would be to have something on chain for this purpose.

[JakeRobinson456]

I think you misunderstood me. You call the ReCaptcha api to verify the captcha on the client side. It is useless this way.

If you don't check the captcha on chain than it is literally useless. An attacker could just call the candy machine program without solving a captcha.

[kevinfaveri]

No, I think you misunderstood me. ReCaptcha here is to prevent crawler bots, not on-chain bots. The ReCaptcha IS working as it should. What you propose is another feature. As I said, a on chain solution. This might be one #47 but still too early