{"record":{"id":"6e055cd5ffe2cd3c","repo":"apereo/cas","slug":"recaptcha-response-token-is-missing-from-the-reque","errorCode":null,"errorMessage":"Recaptcha response/token is missing from the request","messagePattern":"Recaptcha response/token is missing from the request","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-captcha-core/src/main/java/org/apereo/cas/web/flow/ValidateCaptchaAction.java","lineNumber":40,"sourceCode":"@Slf4j\n@RequiredArgsConstructor\npublic class ValidateCaptchaAction extends BaseCasWebflowAction {\n    private final CaptchaValidator captchaValidator;\n\n    private final CaptchaActivationStrategy captchaActivationStrategy;\n\n    @Override\n    protected @Nullable Event doExecuteInternal(final RequestContext requestContext) {\n        if (captchaActivationStrategy.shouldActivate(requestContext, captchaValidator.getRecaptchaProperties()).isEmpty()) {\n            LOGGER.debug(\"Recaptcha is not set to activate for the current request\");\n            return null;\n        }\n\n        val request = WebUtils.getHttpServletRequestFromExternalWebflowContext(requestContext);\n        val userAgent = WebUtils.getHttpServletRequestUserAgentFromRequestContext(requestContext);\n        val gRecaptchaResponse = captchaValidator.getRecaptchaResponse(request);\n        if (StringUtils.isBlank(gRecaptchaResponse)) {\n            LOGGER.warn(\"Recaptcha response/token is missing from the request\");\n            return getError(requestContext);\n        }\n        val result = captchaValidator.validate(gRecaptchaResponse, userAgent);\n        if (result) {\n            LOGGER.debug(\"Recaptcha has successfully validated the request\");\n            return null;\n        }\n        return getError(requestContext);\n    }\n\n    private Event getError(final RequestContext requestContext) {\n        WebUtils.addErrorMessageToContext(requestContext, CasWebflowConstants.TRANSITION_ID_CAPTCHA_ERROR,\n            CasWebflowConstants.TRANSITION_ID_CAPTCHA_ERROR);\n        return getEventFactorySupport().event(this, CasWebflowConstants.TRANSITION_ID_CAPTCHA_ERROR);\n    }\n}\n","sourceCodeStart":22,"sourceCodeEnd":57,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-captcha-core/src/main/java/org/apereo/cas/web/flow/ValidateCaptchaAction.java#L22-L57","documentation":"ValidateCaptchaAction logs this warning when the HTTP request contains no reCAPTCHA response token (the 'g-recaptcha-response' parameter), so there is nothing to verify. The action returns the error event, failing the CAPTCHA portion of the flow.","triggerScenarios":"doExecuteInternal calls captchaValidator.getRecaptchaResponse(request) which returns blank because the browser/client did not submit the g-recaptcha-response parameter (widget not rendered, JS disabled, form field missing, or token already consumed).","commonSituations":"Frontend missing the reCAPTCHA widget or not wiring g-recaptcha-response into the submitted form; JavaScript errors preventing token generation; automated clients posting directly to the endpoint without a token; tokens consumed by a prior submit.","solutions":["Ensure the login page renders the reCAPTCHA widget and the g-recaptcha-response field is included in the POST.","Check browser console for JavaScript failures (blocked google.com/recaptcha scripts, CSP issues).","If integration tests or headless clients are involved, either obtain a valid test token or bypass the captcha feature for that environment.","Confirm the correct request parameter name is being posted for the configured validator."],"exampleFix":"<!-- before: form missing captcha field -->\n<input name=\"username\"/>\n<!-- after -->\n<div class=\"g-recaptcha\" th:attr=\"data-sitekey=${siteKey}\"></div>","handlingStrategy":"validation","validationCode":"// before submitting the login form\ngrecaptcha.ready(() => grecaptcha.execute(siteKey, {action: 'login'}).then(token => {\n  if (!token) throw new Error('recaptcha token missing');\n  form.append('g-recaptcha-response', token);\n}));","typeGuard":"function hasRecaptchaToken(params: URLSearchParams): boolean {\n  return (params.get('g-recaptcha-response') ?? '').trim().length > 0;\n}","tryCatchPattern":"Event e = validateCaptchaAction.execute(requestContext);\nif (CasWebflowConstants.TRANSITION_ID_ERROR.equals(e.getId())) {\n  LOGGER.warn(\"CAPTCHA validation error; prompting user to retry\");\n  modelAndView.setViewName(\"captcha-retry\");\n}","preventionTips":["Verify the reCAPTCHA widget renders and submits its token with the login form.","Check CSP allows scripts from google.com/recaptcha and gstatic.com.","For headless/test environments, disable the captcha feature instead of stubbing tokens.","Monitor the missing-token warning to detect clients bypassing the UI."],"tags":["recaptcha","captcha","webflow","missing-parameter"],"backgroundTag":"missing-required-argument","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}