There is a website I have found where the JavaScript handles the response of the CAPTCHA and then proceeds to fire what I believe is an AJAX request.

So the flow is as follows:

Button -> CAPTCHA-> AJAX

What prevents me let's say from firing that AJAX request myself? It is all client side. Is it worth to try and dig through all the code to find that request? What are some measures that can be used inside JavaScript in general to prevent such a case?

2 Answers 2


If it is a secure CAPTCHA, the AJAX message will send the user's input to a server. The server will validate the input and return a token. The token will then be inserted into the form by the Javascript. When the form is submitted, the server will validate the token with the CAPTCHA service (this could be a web service call or signature validation). So the fact that there is AJAX tells you nothing about the security of the CAPTCHA except that it might be secure.

As far as what prevents you from firing that AJAX request yourself, the answer is nothing. But to do it correctly, you'll need to provide the answer to the CAPTCHA, something that's supposed to be hard for a computer algorithm to determine.

  • You are right, well I diged further, because I haven't work with recaptcha in a long time. They use javascript to communicate server-side and the server communicates with the google captcha servers.
    – iordanis
    May 31, 2016 at 20:01

If the validation (i.e. checking that the user input matches the text on the CAPTCHA) is done client side, nothing is stopping you from bypassing it. You dont even have to read the code - just look at the HTTP request the AJAX send and copy it. This can be done with the developer tool in any browser.

A very basic rule for web security is to never trust the client. Just because the client says the user input matched the CAPTCHA, does not mean it is true. The server must make that comparison and verify that the user input was indeed correct.

You could try to obfuscate the code on the client, but it would not be worth it. Without proper server validation a CAPTCHA is worthless.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .