I'm creating an app that runs both on the web and on mobile (loads offline files through cordova inside a webview)
For my user's login forms in the web vesion, I use google captcha to protect automated logins, works well.
For logins on the app, I can't use captcha because the page is offline, so there is no way I can setup a google captcha domain. Now I can disable the check for recaptcha for this endpoint, but it will be pretty much opening up for bots again, since the user can just use the app id from the app and skip the check.
I have been thinking of a solution but couldn't find any that seemed simple to implement. Any ideas?