# Passwordless Authentication - reCAPTCHA Integration

Source: https://apereo.github.io/cas/development/authentication/Passwordless-Authentication-Recaptcha.html

Passwordless authentication attempts can be protected and integrated with [Google reCAPTCHA](https://developers.google.com/recaptcha). This requires the presence of reCAPTCHA settings for the basic integration and instructing the password management flow to turn on and verify requests via reCAPTCHA.

The following settings and properties are available from the CAS configuration catalog:

- `cas.authn.passwordless.google-recaptcha.enabled` (Required; type `Boolean`; default `true`): Whether reCAPTCHA should be enabled.
- `cas.authn.passwordless.google-recaptcha.score` (Required; type `Double`; default `0.5`): Google reCAPTCHA v3 returns a score (1.0 is very likely a good interaction, 0.0 is very likely a bot). reCAPTCHA learns by seeing real traffic on your site. For this reason, scores in a staging environment or soon after implementing may differ from production. As reCAPTCHA v3 doesn't ever interrupt the user flow, you can first run reCAPTCHA without taking action and then decide on thresholds by looking at your traffic in the admin console. By default, you can use a threshold of 0.5.
- `cas.authn.passwordless.google-recaptcha.secret` (Required; type `String`): The reCAPTCHA site secret.
- `cas.authn.passwordless.google-recaptcha.site-key` (Required; type `String`): The reCAPTCHA site key.
- `cas.authn.passwordless.google-recaptcha.activate-for-ip-address-pattern` (Optional; type `String`): A regular expression pattern to indicate that captcha should be activated when the remote IP address matches this pattern, and otherwise skipped and disabled.
- `cas.authn.passwordless.google-recaptcha.headers` (Optional; type `Map<String,String>`): Headers, defined as a `Map`, to include in the request when making the verification call to the recaptcha API.
- `cas.authn.passwordless.google-recaptcha.invisible` (Optional; type `Boolean`; default `false`): Whether google reCAPTCHA invisible should be enabled.
- `cas.authn.passwordless.google-recaptcha.position` (Optional; type `String`; default `bottomright`): The google reCAPTCHA badge position (only if invisible is enabled). Accepted values are: - `bottomright`: bottom right corner, default value. - `bottomleft`: bottom left corner - `inline`: allows one to control the CSS.
- `cas.authn.passwordless.google-recaptcha.verify-url` (Optional; type `String`; default `https://www.google.com/recaptcha/api/siteverify`): The reCAPTCHA endpoint for verification of the reCAPTCHA response. The endpoint is specific to the reCAPTCHA provider: - For Google reCAPTCHA, the endpoint is `https://www.google.com/recaptcha/api/siteverify`. - For hCaptcha, the endpoint is `https://hcaptcha.com/siteverify`. - For Turnstile, the endpoint is `https://challenges.cloudflare.com/turnstile/v0/siteverify`.
- `cas.authn.passwordless.google-recaptcha.version` (Optional; type `GoogleRecaptchaProperties.RecaptchaVersions`; default `GOOGLE_RECAPTCHA_V2`): Indicate the version of the recaptcha api. Available values are as follows: - `GOOGLE_RECAPTCHA_V2`: V2 version of the recaptcha API. - `GOOGLE_RECAPTCHA_V3`: V3 version of the recaptcha API. - `HCAPTCHA`: hCaptcha is an alternative to reCAPTCHA that requires website visitors to label images as part of its business model. The provider is more focused on manual image recognition challenges. It is a image classification task based CAPTCHA provider employing visual challenges like identifying objects. - `TURNSTILE`: Offers a CAPTCHA alternative by Cloudflare that prioritizes user experience and privacy. Turnstile delivers frustration-free, CAPTCHA-free web experiences to website visitors - with just a simple snippet of free code. Moreover, Turnstile stops abuse and confirms visitors are real without the data privacy concerns or awful user experience of CAPTCHAs. - `FRIENDLY_CAPTCHA`: Friendly captcha is a European alternative, accessible and GDPR compliant.