Repository: auth0/auth0.js
Pull request #1170 (2021-04-21 09:55:10)

Feature/recaptcha enterprise cauth 965
### Changes

Change URL used to render recaptcha (v2 and enterprise) widgets from google.com to recaptcha.net

It is preferred to use recaptcha.net when google.com is unavailable (i.e. for use in countries where the google.com domain is blocked).

This is done in universal-login-prompts in this approved PR https://github.com/auth0/universal-login-prompts/pull/1080/files#r616729196

### References

https://developers.google.com/recaptcha/docs/faq#can-i-use-recaptcha-globally
https://auth0team.atlassian.net/browse/CAUTH-965


### Testing

Same as testing required for https://github.com/auth0/auth0.js/pull/1169

1. Enable Always on Captcha in the Dashboard under Security -> Bot Detection -> Captcha -> Always On
2. Enable Google ReCaptcha (reach out if you need a site key and secret, you can get free ones here - https://www.google.com/recaptcha/admin. Remember to select v2).
3. Run the auth0js SDK locally
4. Update your universal login template to point to the locally served auth0js sdk:
  - Go to Branding -> Universal Login and Select Classic
  - Click the Login tab and select Customize Login Page
  - Select the Lock template and change the auth0.min.js script src to `http://localhost:3000/auth0.js`


- [ ] This change adds unit test coverage
- [ ] This change adds integration test coverage

### Checklist

- [ ] I have read the [Auth0 general contribution guidelines](https://github.com/auth0/open-source-template/blob/master/GENERAL-CONTRIBUTING.md)
- [ ] I have read the [Auth0 Code of Conduct](https://github.com/auth0/open-source-template/blob/master/CODE-OF-CONDUCT.md)
- [ ] All tests and linters described in the [Develop section](https://github.com/auth0/auth0.js#develop) run without errors



Patch:
diff --git a/src/web-auth/captcha.js b/src/web-auth/captcha.js
index e0464db..66758d5 100644
--- a/src/web-auth/captcha.js
+++ b/src/web-auth/captcha.js
@@ -69,14 +69,14 @@ function scriptForRecaptchaProvider(provider, lang, callback) {
   switch (provider) {
     case RECAPTCHA_V2_PROVIDER:
       return (
-        'https://www.google.com/recaptcha/api.js?hl=' +
+        'https://www.recaptcha.net/recaptcha/api.js?hl=' +
         lang +
         '&onload=' +
         callback
       );
     case RECAPTCHA_ENTERPRISE_PROVIDER:
       return (
-        'https://www.google.com/recaptcha/enterprise.js?render=explicit&hl=' +
+        'https://www.recaptcha.net/recaptcha/enterprise.js?render=explicit&hl=' +
         lang +
         '&onload=' +
         callback


Test patch:
diff --git a/test/web-auth/captcha.test.js b/test/web-auth/captcha.test.js
index 04fef92..e234076 100644
--- a/test/web-auth/captcha.test.js
+++ b/test/web-auth/captcha.test.js
@@ -215,7 +215,7 @@ describe('captcha rendering', function () {
           }
         };
         c = captcha.render(mockClient, element);
-        recaptchaScript = [...window.document.querySelectorAll('script')].find(s => s.src.match('google\.com'));
+        recaptchaScript = [...window.document.querySelectorAll('script')].find(s => s.src.match('recaptcha.net'));
         scriptOnLoadCallback = window[url.parse(recaptchaScript.src, true).query.onload];
       });
   
@@ -226,7 +226,7 @@ describe('captcha rendering', function () {
       it('should inject the recaptcha script', function () {
         expect(recaptchaScript.async).to.be.ok();
         const scriptUrl = url.parse(recaptchaScript.src, true);
-        expect(scriptUrl.hostname).to.equal('www.google.com');
+        expect(scriptUrl.hostname).to.equal('www.recaptcha.net');
         expect(scriptUrl.pathname).to.equal(`/recaptcha/${getScript()}`);
         expect(scriptUrl.query.hl).to.equal('en');
         expect(scriptUrl.query).to.have.property('onload');