title: Google reCaptcha test with Postman
body: <p>I am creating a backend endpoint to handle user login. Part of the login is a Google <a href="https://www.google.com/recaptcha/about/" rel="nofollow noreferrer">reCaptcha</a>.</p>
  <p><a href="https://i.stack.imgur.com/hKPQZ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/hKPQZ.png" alt="enter image description here" /></a></p>
  <p>I am also creating Postman collections to test the backed api's. I have the following:</p>
  <p><strong>AuthenticationResource.java</strong></p>
  <pre><code>@POST
  @Path(&quot;login&quot;)
  @ApiOperation(value=&quot;Login a user with a username and password and return a jwt&quot;)
  @ApiResponses({
          @ApiResponse(code=200, message=&quot;Success&quot;),
          @ApiResponse(code=404, message=&quot;Not Found&quot;)
  })
  @Consumes({ MediaType.APPLICATION_JSON })
  @Produces({ MediaType.APPLICATION_JSON })
  public Response login(@ApiParam(required = true) UserLoginDTO userLogin, @Context HttpServletRequest request)  {
      try {
          HttpSession session = request.getSession(true);
  
          logger.info(&quot;login: &quot;+userLogin.getUsername());
          String username = userLogin.getUsername();
          String passwordPlainText = userLogin.getPassword();
          String clientRemoteAddr = request.getRemoteAddr();
  
          boolean captchaVerified = VerifyRecaptcha.verify(userLogin.getRecaptcha());
          if (!captchaVerified) {
              logger.severe(&quot;Invalid captcha&quot;);
              return Response.status(Response.Status.BAD_REQUEST).entity(&quot;Invalid captcha&quot;).build();
          }
  </code></pre>
  <p><strong>VerifyRecaptcha.java</strong></p>
  <pre><code>public class VerifyRecaptcha {
  
      private static final Logger logger = Logger.getLogger(VerifyRecaptcha.class.getName());
      public static final String url = &quot;https://www.google.com/recaptcha/api/siteverify&quot;;
      public static final String secret = &quot;my-seceret-key&quot;;
      private final static String USER_AGENT = &quot;Mozilla/5.0&quot;;
  
      public static boolean verify(String gRecaptchaResponse) throws IOException {
          if (gRecaptchaResponse == null || &quot;&quot;.equals(gRecaptchaResponse)) {
              return false;
          }
  
          try{
              URL obj = new URL(url);
              HttpsURLConnection con = (HttpsURLConnection) obj.openConnection();
  
              // add reuqest header
              con.setRequestMethod(&quot;POST&quot;);
              con.setRequestProperty(&quot;User-Agent&quot;, USER_AGENT);
              con.setRequestProperty(&quot;Accept-Language&quot;, &quot;en-US,en;q=0.5&quot;);
  
              String postParams = &quot;secret=&quot; + secret + &quot;&amp;response=&quot;
                      + gRecaptchaResponse;
  
              // Send post request
              con.setDoOutput(true);
              DataOutputStream wr = new DataOutputStream(con.getOutputStream());
              wr.writeBytes(postParams);
              wr.flush();
              wr.close();
  
              int responseCode = con.getResponseCode();
              logger.info(&quot;\nSending 'POST' request to URL : &quot; + url);
              logger.info(&quot;Post parameters : &quot; + postParams);
              logger.info(&quot;Response Code : &quot; + responseCode);
  
              BufferedReader in = new BufferedReader(new InputStreamReader(
                      con.getInputStream()));
              String inputLine;
              StringBuffer response = new StringBuffer();
  
              while ((inputLine = in.readLine()) != null) {
                  response.append(inputLine);
              }
              in.close();
  
              // print result
              logger.info(response.toString());
  
              //parse JSON response and return 'success' value
              JsonReader jsonReader = Json.createReader(new StringReader(response.toString()));
              JsonObject jsonObject = jsonReader.readObject();
              jsonReader.close();
  
              return jsonObject.getBoolean(&quot;success&quot;);
          }catch(Exception e){
              logger.warning(&quot;invalid recaptcha: &quot;+gRecaptchaResponse+&quot;. &quot;+e.getMessage());
              e.printStackTrace();
              return false;
          }
      }
  }
  </code></pre>
  <p><strong>Postman</strong></p>
  <pre><code>POST https://localhost:8443/corporateInterface/rest/user/login
  </code></pre>
  <p>Body</p>
  <pre><code>{
      &quot;password&quot;: &quot;password&quot;,
      &quot;username&quot;: &quot;richard&quot;,
      &quot;recaptchaResponse&quot;: &quot;sitekey&quot;
  }
  </code></pre>
  <p><strong>Result</strong></p>
  <pre><code>Response Code : 200
  {  &quot;success&quot;: false,  &quot;error-codes&quot;: [    &quot;invalid-input-response&quot;  ]}
  Invalid captcha
  </code></pre>
  <p>As you can see, the call to <a href="https://www.google.com/recaptcha/api/siteverify" rel="nofollow noreferrer">https://www.google.com/recaptcha/api/siteverify</a> returns a 200, but success is false.</p>
  <p><strong>Question</strong></p>
  <p>Is it possible to test the reCaptcha with Postman? Or will Google not validate a Postman request?  If so, what am I doing wrong?</p>