Integrate with Google Cloud Armor for websites

This document shows you how to integrate reCAPTCHA for Cloud Armor on websites.

To complete the integration, you must implement one or more features of reCAPTCHA for Cloud Armor and configure Cloud Armor security policies.

Before you begin

  1. Enable the reCAPTCHA Enterprise API.

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the API

  2. Plan how you want to implement the features of reCAPTCHA for Cloud Armor to protect your website.

    1. Choose one or more WAF features that best match your use case.
    2. Identify the pages that you want to protect and the type of Cloud Armor feature that you want to implement on those pages.

Implement features of reCAPTCHA for Cloud Armor

Depending on your requirements, you can use one or more features of reCAPTCHA for Cloud Armor in a single application.

If you want to use more than one feature, then you must create a reCAPTCHA key for each of those features and use them in your application. For example, if you want to use reCAPTCHA action-tokens and reCAPTCHA challenge page, then you must create an action-token key and a challenge-page key, and use them in your application.

Implement reCAPTCHA action-tokens

You must have reCAPTCHA running on your web pages to generate action-tokens. After reCAPTCHA generates an action-token, you attach the action-token to a predefined request header wherever you need to protect any user action, such as checkout. By default, action-tokens are valid for 30 minutes, but can vary depending on the traffic. You must attach the action-token to a predefined request header before the token expires, so that the Cloud Armor can evaluate the token attributes.

To implement a reCAPTCHA action-token, do the following:

  1. Create an action-token key for your website.

    Cloud console

    1. In the Google Cloud console, go to the Google Cloud Fraud Defense page.

      Go to Google Cloud Fraud Defense

    2. Verify that the name of your project appears in the resource selector at the top of the page.

      If you don't see the name of your project, click the resource selector, then select your project.

    3. Select the Keys tab.
    4. Click Create key.
    5. In the Display name field, enter a display name for the key.
    6. Depending on the platform for which you want to create reCAPTCHA keys for WAF, perform the appropriate action:
      1. For the Application type, select Web.