Overview

The CaptchaFailedEventV1 is a log event emitted when the BFF Web service fails to validate a reCAPTCHA v3 token. This may indicate bot activity, missing tokens, or configuration issues.

When is this event emitted?

This event is logged when:

• A request requires CAPTCHA but no token is provided
• The reCAPTCHA token is invalid or expired
• Google’s siteverify API returns a score below the threshold
• The CAPTCHA service is misconfigured

Key Information

The event payload includes:

• Reason: The specific failure reason
• Score: The risk score if available
• Advisory Mode: Whether the request was allowed despite failure

Failure Reasons

Reason	Description
missing_token	No x-recaptcha-token header provided
missing_secret	Server-side secret not configured
low_score	Score below configured threshold
verification_failed	Google API rejected the token
action_mismatch	Token action doesn’t match expected
hostname_mismatch	Token hostname doesn’t match expected

Advisory Mode

When recaptchaAdvisory is enabled (non-production), failed validations are logged but requests are allowed to proceed. This helps identify issues without blocking legitimate traffic during testing.

Use Cases

This event is used for:

• Detecting bot attack patterns
• Monitoring CAPTCHA configuration issues
• Identifying misconfigured client applications
• Security incident investigation