14

My client want to use Google's No CAPTCHA reCAPTCHA (NCRC) to prevent robots completing an application.

QA have automated this process, but if the business introduce NCRC into the form, then this will prevent QA from being able to automate the application.

Is anyone aware of a way around this, whilst keeping the same build in Live and QA? I'm hoping there's a 'test mode' we can switch on for QA, but I can't find anything in the documentation.

Edit / Solution: You can now automate reCAPTCHA v2, thanks to @Andrei Fierbinteanu for the link. This won't work on v1, so you need to upgrade. Just make sure you're using the correct keys in QA and Production.

Improve this question
6
  • it always amazes me that google does not have some sort of test mode, or at the very least a recommended solution to this kind of problem in their FAQ for their captcha stuff.
    – Chuck van der Linden
    Mar 28, 2015 at 0:35
  • 3
    There is a test account (not sure if it was there when the question was asked). More info here: developers.google.com/recaptcha/docs/… Basically use these credentials for no validation needed: Site key: 6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI Secret key: 6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe
    – Andrei Fierbinteanu
    May 3, 2016 at 7:49
  • Thank you, @AndreiFierbinteanu - that's exactly what we were after! I don't believe that was available when the question was asked, so that's really useful to know - cheers!
    – dvniel
    May 3, 2016 at 14:02
  • 1
    Update: reCapture v2 now includes a feature to cater for automated tests
    – dank8
    Sep 14, 2017 at 0:20
  • 1
    The comment from @AndreiFierbinteanu above has the correct answer from 3+ years ago, which none of the actual answers mention. For anyone wondering, use the special site code Google has provided: developers.google.com/recaptcha/docs/…
    – bsplosion
    May 17, 2019 at 20:46

4 Answers 4

Reset to default
10

Cleanest solution is to get it removed for QA environment (render it conditionally) - you have one right? You do test BEFORE deploying to production? So don't use CAPTCHA in environment where you run automated tests.

If you cannot, use automated humans: there are companies which will solve CAPTCHA for you - it is quite cheap, 1000 for a buck, with decent success rate, response within 15 secs. This of course will add complexity to your tests: your test need to submit CAPTCHA to vendor and get response.

Exactly same build in QA and in production, when production prevents automated scripts, allows for manual testing only in QA. Someone should start to think and re-evaluate dogmatic requirements.

What is the goal: blindly implement requirements (no questions asked), or create process which allows for productive development and testing.

Improve this answer
3
  • Thanks Peter, but the requirements are to keep the same build in QA and live... so whatever's tested in QA each sprint is an exact copy of what's deployed
    – dvniel
    Mar 13, 2015 at 17:03
  • 2
    Well, your requirement does NOT allow you to test your app. Someone needs to re-evaluate requirements. If you charge for services, does your company to plan charge selenium testbot for using website? Good luck!
    – Peter M. - stands for Monica
    Mar 13, 2015 at 17:47
  • 2
    To be fair there is probably a lot of app that can still be tested. Heck you can probably even test things like new user generation or comment generation by making direct api calls or something. Still for stuff protected by captcha you basically gotta tell the powers that be that they cannot have it both ways. The same captcha that blocks robots will block test automation (or it fails at its purpose). Tell your bosses to Pick One: Automated testing for those areas or captcha fully enabled in QA environments.
    – Chuck van der Linden
    Mar 28, 2015 at 0:39
1

In order to keep the same build for testing as production there needs to be some sort of toggle in the application. Preferable in a configuration file (or database setting). By default the useCaptcha setting is enabled, but in the test environment you disable this in the configuration file.

This means the code will have two paths

  1. One that does not load the captcha at all and continues without it
  2. One that displays the captcha and requires user input

Still you would need to manual test that it works without the configuration setting, but that only needs to be done once each release cycle.

Its up to the development team to help you make the application testable, this is common way for solving this challenge.

Improve this answer
0

From what I understand, you have two options:

  1. If it's a local instance of reCaptcha, then you can look up the image ID in the database to find the code it's tied to.
  2. Have your Dev install a backdoor. So that when a specific input is received the application does not post the result to Google's API but rather allows you to move on as if the response from the API call was successful.
Improve this answer
2
  • 1
    The new reCAPTCHA doesn't contain any text or image (it's just a checkbox) so isn't stored anywhere. It's also hosted by Google, which means we can't install a backdoor or trick the API
    – dvniel
    Mar 13, 2015 at 16:58
  • @theonlydanever, I believe option #2 is still viable. The Dev would check the input before sending it off to Google's API and just allow the login process to continue.
    – kirbycope
    Mar 13, 2015 at 21:04
0

If this has to be the same copy you ship and you cannot modify it, you cannot test beyond the captcha. That is the reason of having captchas - to avoid automation.

So the only option is to build in something into your app that makes testing possible. This of course will pose the risk of getting out into the field and mess things up.

I only can imagine some ways of doing it without too much risk for live. According to the Google doc, your application still has to evaluate the result Google sends back, hence even with a false, you can permit the submit.

  • permit a list of really good unique keys as solution and rotate them with each new build (such as 987asdhats6df87a6s87df87a6sdf)
  • implement an OTP and because you and the app know the start seed and are synced, you can pass in valid parameters (http://en.wikipedia.org/wiki/One-time_password), no list has to be maintained, hence you can even test later on live again
  • evaluate on which installation/in which environment the software runs and enable or disable to verification of the captcha challenge
Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.