Token Refresh incurring unnecessary charges for Enterprise

Created on 7 January 2025, 16 days ago

Problem/Motivation

Auto refreshing the token every 90 seconds works well for most implementations.
For enterprise websites with millions of page loads however, refreshing the token is incurring unnecessary Google API charges.

In the ticket where the token refresh was initially introduced, the argument was made that certain JavaScript features were not supported by IE, and therefore could not be used in the solution:
https://www.drupal.org/project/recaptcha_v3/issues/3145790#comment-13678457 β†’

Both deficiencies are no longer an issue with modern browsers, and the solution can be revisited.

Steps to reproduce

Implement module on enterprise site with millions of page loads.
Token auto-refresh can incur significant costs in monthly charges.

Proposed resolution

Call grecaptcha.execute only once on form submit. Example:

https://stackoverflow.com/a/60067347/4795539

Remaining tasks

Discuss whether this is a replacement for existing functionality or an option in module configuration.
Deploying this feature as an alternate option may be a good way to ensure backwards compatibility while providing the new method to site managers for testing.

User interface changes

Alternative implementation option in module configuration?
Alternate script included in page?

API changes

Call grecaptcha.execute only on form submit, reducing calls to the Google api.

Data model changes

Configuration changes

✨ Feature request
Status

Active

Version

2.0

Component

Code

Created by

πŸ‡ΊπŸ‡ΈUnited States jimconte

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Production build 0.71.5 2024