reCAPTCHA v3 is a core module as of Miva 26.03.00. The module can protect runtime JSON API functions as well as Miva form actions. Each configured action now has a type:
| Type | Protects | Value format |
|---|---|---|
| Miva Form Action | A form submission, identified by its Action value |
AUTH, ICST, TGRADD |
| Function | A runtime JSON API call | Runtime_BasketItem_Update, Module:tgreviews:Runtime_Product_Review_Insert |
The same value can be configured once per type.
Function reference format#
Function values use the same format as API token function permissions.
- A core JSON API function is its name:
Runtime_Customer_Login. - A module’s JSON function is
Module:<module code>:<function name>.
For example, Module:tgreviews:Runtime_Product_Review_Insert is the Runtime_Product_Review_Insert function in the Product Reviews module (tgreviews).
Default protected actions#
New installs have these configured actions. Upgrades to 26.03.00 add them too, whether or not Product Reviews is installed.
| Value | Type | Notes |
|---|---|---|
Runtime_Customer_Login |
Function | |
TGRADD |
Miva Form Action | Added only if it doesn’t already exist |
Module:tgreviews:Runtime_Product_Review_Insert |
Function |
How runtime requests are protected#
The module uses the JSON CAPTCHA feature.
Storefront#
When the page loads, the module registers 1 implementation with AJAX_Runtime_CAPTCHA_Register. It covers every enabled Function configured action.
When a page calls a protected function through AJAX_Call_JSON or AJAX_Call_Module_JSON, the implementation requests a reCAPTCHA token for that configured action and adds it to the request as reCAPTCHAv3_Response. Calls to unprotected functions go out without a token.
Code that sends a runtime request some other way has to add the token itself, in reCAPTCHAv3_Response.
Server#
The module’s Module_JSON_CAPTCHA builds a function reference from the request (Function, or Module:<Module_Code>:<Module_Function> for module calls) and checks it against the Function configured actions:
| Condition | Result |
|---|---|
| The module’s settings can’t be loaded, or the site key or secret key is empty | Permitted |
| No Function configured action matches the function | Permitted |
| Loading the configured action fails with an error other than “not found” | Blocked |
| A configured action exclusion matches a request parameter | Permitted |
reCAPTCHAv3_Response passes verification against the configured action’s score threshold |
Permitted |
| Verification fails | Blocked. The response is a JSON error with the verification error code and message, and the function doesn’t run. |
Configured action exclusions work for functions the same way they work for form actions. A rejected function call is recorded in the Rejections list with the Function type.