EU CAPTCHA for ASP.NET

Frequently Asked Questions

• How do I add EU CAPTCHA to an ASP.NET application?

  Register an IHttpClientFactory-backed typed client for the EU CAPTCHA verification API in your DI container. Add verify.js and the widget div to your Razor views. In your controller actions, read Request.Form['eu-captcha-response'], send it to the EU CAPTCHA API using your typed client with your secret key, and only process the form if verification succeeds.

• Does EU CAPTCHA work with ASP.NET MVC and Razor Pages?

  Yes. EU CAPTCHA integrates with both ASP.NET MVC controllers and Razor Pages. In MVC, read the token from the posted form data in your controller action. In Razor Pages, access it via Request.Form in the OnPost handler. Both approaches follow the same pattern: verify the token server-side before processing the page model or view model.

• How do I verify a CAPTCHA token in an ASP.NET controller action?

  Inject the EU CAPTCHA typed HTTP client into your controller via the constructor. In the action that handles the form POST, read the token from Request.Form['eu-captcha-response'] or as a model-bound parameter. Call the client's verification method with your secret key and the token, and return a redirect with an error message or a 400 response if verification fails.

• Can I implement EU CAPTCHA verification as an ASP.NET action filter?

  Yes. Create a custom ActionFilterAttribute that overrides OnActionExecutingAsync. Inject the EU CAPTCHA HTTP client via the filter's constructor or use the HttpContext to resolve it from the DI container. Perform the token verification and either allow the action to proceed or short-circuit it with an error result. Apply the filter attribute to individual actions or entire controllers.

• How do I store the EU CAPTCHA secret key securely in ASP.NET?

  Store the secret key in appsettings.json under a dedicated configuration section and override it in production using environment variables or ASP.NET's User Secrets for development. For production, use Azure Key Vault, AWS Secrets Manager, or the equivalent secrets management service for your hosting environment. Never commit the secret key to source control.

• Is EU CAPTCHA compatible with ASP.NET Web API?

  Yes. For Web API endpoints that receive form data or JSON containing the CAPTCHA token, inject the EU CAPTCHA HTTP client into your ApiController or ControllerBase class. Read the token from the request body, verify it with the EU CAPTCHA API, and return an appropriate HTTP status code (400 or 422) if verification fails before executing the endpoint logic.

• Is EU CAPTCHA GDPR compliant for ASP.NET applications?

  Yes. EU CAPTCHA is operated by an EU-based company, is hosted entirely in Germany, and does not rely on US cloud providers or infrastructure subject to US surveillance laws. The service processes only the data necessary to provide and verify the CAPTCHA (such as IP address and technical browser information) in line with the GDPR. Your organisation remains responsible for providing transparent privacy information, selecting an appropriate legal basis, and obtaining any required consent for your specific ASP.NET implementation. This information does not constitute legal advice; please consult your legal counsel for an assessment of your individual case.