backend

Here's a close case that works:

I received an official response for the reCAPTCHA Enterprise support team:

Thanks for reaching out here. We recommend not putting a checkbox behind a score. More details are available on this here: https://cloud.google.com/recaptcha-enterprise/docs/faq#id_like_to_use_the_score_from_to_show_a_challenge_checkbox_widget_how_can_i_do_this

Not only are there concerns listed in that FAQ point about the efficacy of a checkbox widget when placed behind a score, but it also over simplifies how the checkbox widget works. We perform "adversarial challenging" on our checkbox widget (essentially, we show harder challenges to known attackers), but we're unable to do so when placed behind a score reCAPTCHA.

All of this being said, if you do wish to do it anyway, you would have to include the JS file twice.

And this is from the link posted in their email:

I'd like to use the score from reCAPTCHA Enterprise to show a challenge / checkbox widget. How can I do this?

We recommend that you do not do this. reCAPTCHA Enterprise expects to see both good and bad user behavior on implementation. If you trigger a reCAPTCHA Enterprise checkbox widget based on a reCAPTCHA Enterprise score, the checkbox widget is only being exposed to bad traffic. Due to this, the widget can have a more difficult time determining whether to show a challenge or not. This can result in issuing NO CAPTCHAs (no challenge shown at all) to fraudulent users or bots due to trouble making that differentiation.

In these cases, we recommend just using a challenge-based site key upfront (like reCAPTCHA Enterprise with a CHECKBOX Site Key) instead, but installing a SCORE Site Key on every page, as well as issuing grecaptcha.enterprise.execute to train the model, but foregoing assessments on the SCORE tokens. Essentially, this achieves the goal by training the reCAPTCHA Enterprise CHECKBOX site keys on user behavior, resulting in less challenges shown to legitimate users and more challenges to fraudulent ones.

After digging around and trying a bunch of solutions, here is what worked:

1.) I changed my docker file to run an nginx server:

Send your data to separate processes. I used concurrent.futures because I like the simple interface.

This runs in about 11 seconds on my computer.

firebaser here

Firebase itself passes the ID token with each request, and then uses that on the server to identify the user and to determine whether they're authorized to perform the operation. This is a common (I'd even say idiomatic) approach to authentication and authorization, and if there's a security risk that you've identified in it, we'd love to hear about it on https://www.google.com/about/appsecurity/

From reading the blog post it seems the author is making a distinction between authentication (the user proving their identify) and authorization (them getting access to certain resources based on that identity), but it'd probably be best to ask the author for more information on why that would preclude passing an ID token to identify the user.

To validate that the new value is one higher than the existing value:

you have to pass user id when you are calling ajax. If you are using GETmethod than pass user id in URL and access it via argument in your view for eg.

You can make an internal call from the server itself, rather than from within a client. It would follow exactly the same logic (with the interval), but the code would be on the backend :)

Also if you'd like it a bit more well defined, you could use something like node-cron:

React is a framework that is state-based - the state informs the render of the DOM. Trying to use querySelector and its equivalent won't work like you think it will.

So here's an example of this working.

1. We set the state to be the index of the span (initially nothing).

2. handleClick which is attached to the div (or would be attached to your Scale element) grabs the data id attribute from the span and adds it to the state.

3. This triggers the page to re-render, the spans get rebuilt, and depending on the state the selected class gets added.

There is no other DOM manipulation going on. React does all that heavy lifting for you.