This document helps you understand the features of reCAPTCHA for Google Cloud Armor and determine which feature best matches your use case.
reCAPTCHA offers the following features that you can use to integrate with Google Cloud Armor:
Features overview
reCAPTCHA for Google Cloud Armor integrations support action-tokens, session-tokens and challenge page.
You can use one or more reCAPTCHA for Google Cloud Armor features in a single application. For example, you can choose to apply a session-token for all pages, and based on the session-token's score, you can redirect suspicious requests to the reCAPTCHA challenge page. Also, you can use an action-token for high-profile actions, such as checkout. For more information, see examples.
The following table shows a brief comparison of the available reCAPTCHA for Google Cloud Armor features:
| Comparison category | reCAPTCHA action-tokens | reCAPTCHA session-tokens | reCAPTCHA challenge page |
|---|---|---|---|
| Use case | Use to protect user actions, such as login or comment posts. | Use to protect the whole user session on the site's domain. | Use when you suspect spam activity directed to your site and you
need to screen out bots.
This method interrupts a user's activity because the user has to verify a CAPTCHA challenge. |
| Supported platforms | Websites and mobile applications | Websites | Websites |
| Client integration effort | Medium
Manual client-side integration. |
Medium
Install reCAPTCHA JavaScript manually or through injection on the WAF. |
Low
Interstitial triggered by security policies. |
| Detection accuracy | Highest
Client, server, and action specific signals are available. |
High
Client and server speicific signals are available. |
Medium
Client and server speicific signals are available. Client signals are only available in an interstitial page. |
| Supported reCAPTCHA version | reCAPTCHA score-based and checkbox keys | reCAPTCHA score-based keys | reCAPTCHA challenge-based keys embedded in an interstitial page |
reCAPTCHA action-tokens
You can use reCAPTCHA action-tokens to protect important user interactions, such as checkout on web pages and on mobile applications.
The reCAPTCHA action-tokens workflow consists of the following steps:
- When an end user triggers an action protected by reCAPTCHA, the web page or the mobile application sends signals that are collected in the browser to reCAPTCHA for analysis.
- reCAPTCHA sends an action-token to the web page or the mobile application.
- You attach this action-token to the header of the request that you want to protect.
- When the end user requests access with the action-token, Google Cloud Armor decodes and validates the action-token attributes instead of your backend application.
- Google Cloud Armor applies actions based on your configured security policy rules.