My mind has been consumed by thoughts about the safety of my projects, especially when it comes to password recovery.
On the password recovery page, users must fill out a form with valid data and complete a recaptcha test for security.
To enhance user experience, I conduct checks using ajax. If no errors are found, I grant access to the page.
$.ajax(configAjax).done(data => {
if(data.result !== "success") {
sendErrorMessage(data.message);
grecaptcha.reset();
event.preventDefault();
}
else {
done = true;
}
toggleLoading();
})
Everything seems fine, but I've always been warned not to fully trust client-side data.
If a user were able to alter, for example, from !== to ===, they could bypass the recaptcha check.
I considered conducting the recaptcha check twice - once in ajax and once on page update with the POST request. However, this resulted in an error due to making two requests too quickly.
This leads me to question: is it actually possible for someone to exploit this vulnerability?