Is sending recaptchaPublicKey & RecaptchaToken in the post request a potential security threat?

Question

I have implemented reCaptcha in login form to slow down the potential brute force attack. However, the application sends recaptchaPublicKey & RecaptchaToken in the post request along with the login credentials. Does it lead to a security threat? As per my understanding, if the application reflects secrets ( such as tokens) in HTTP response bodies, that will be classified as potential BREACH (Browser Reconnaissance & Exfiltration via Adaptive Compression of Hypertext) attack.

Is it safe to send RecaptchaToken in post request?

Answer 1

Sending the extra fields in the request is no problem. Depending on your server-side implementation, you might need them to validate the request. You should have no need to reflect them, so this would not lead to an XSS. In any case, this would not be a BREACH attack -- a BREACH attack requires that the attacker is able to control part of the page, and I fail to see how this would be the case with ReCaptcha. (Unless you consider Google to be the attacker, but then including their javascript on your site would have given them access anyway, so it does not change the threat landscape.)