Validating ReCaptcha (Javascript API) User Answer on Localhost with ASP.NET

Question

I am using ReCaptcha with the javascript API on my aspx page on localhost. I read somewhere that I don't need a key as long as I use it on localhost. So, I use some random key that I found somewhere. I could render the recaptcha challenge successfully. The following is my javascript code.

Recaptcha.create("6Ld4iQsAAAAAAM3nfX_K0vXaUudl2Gk0lpTF3REf", 'captchadiv',
{
    tabindex: 1,
    theme: "clean",
    callback: Recaptcha.focus_response_field
});


//To Validate user response
function Recaptcha_IsCorrect()
{
    var xmlHttpRequest;
    var PageURL = document.URL;
    var xmlDoc;

    if (window.XMLHttpRequest)
    {
        xmlHttpRequest = new XMLHttpRequest();
    }
    else
    {
        xmlHttpRequest = new ActiveXObject("Microsoft.xmlHttpRequest");
    }

    var challenge = Recaptcha.get_challenge();
    var userResponse = Recaptcha.get_response();

    var url = "../Ajax/PIAsyncAjax.asmx/ValidateReCaptcha?clientIP=127.0.0.1&privateKey=6Ld4iQsAAAAAAM3nfX_K0vXaUudl2Gk0lpTF3REf&challenge=" + challenge + "&response=" + userResponse;

    xmlHttpRequest.open("GET", url);
    xmlHttpRequest.onreadystatechange = function ()
    {
        if (xmlHttpRequest.readyState == 4 && xmlHttpRequest.status == 200)
        {
            alert(xmlHttpRequest.responseText);
        }
    };

    xmlHttpRequest.send();
}    

The following is my code for the webservice which exposed the webmethod to validate ReCaptcha user input. I get the error "invalid-site-private-key".

namespace YADA.YADAYADA{

[WebService(Namespace = "http://tempuri.org/")]
[WebServiceBinding(ConformsTo = WsiProfiles.BasicProfile1_1)]
[System.ComponentModel.ToolboxItem(false)]   
public class PIAsyncAjax : System.Web.Services.WebService
{       
    [WebMethod]
    public string ValidateReCaptcha(string clientIP, string privateKey, string challenge, string response)
    {

        bool isValid = false;
        string validationResponse = "";

        reCaptchaValidation validator =
            new reCaptchaValidation(null,       
                                    clientIP,
                                    privateKey,
                                    challenge,
                                    response);

        isValid = validator.Validate();

        if (isValid)
        {
            validationResponse = "true";
        }
        else
        {
            if (!validator.IsErrored)
            {
                validationResponse = "false";
            }
            else
            {
                // oh dear, something not right

                if (validator.Exception != null)        // an exception occurred while 
                    // trying to validate
                    validationResponse = validator.Exception.ToString();
                else if (validator.ValidationResult != null)  // the validation web service 
                    // returned an error code 
                    // (other than an invalid captcha solution)
                    validationResponse = "web service error: " + validator.ValidationResult;
            }
        }

        return validationResponse;
    }
}


public class reCaptchaValidation
{
    private string challenge, response, privateKey, ip;
    private IWebProxy proxy;

    public reCaptchaValidation(string clientIP, string privateKey, 
    string challenge, string response) : this(null, clientIP, privateKey, 
    challenge, response) { }

    public reCaptchaValidation(IWebProxy proxy, string clientIP, 
        string privateKey, string challenge, string response)
    {
        this.proxy = proxy;
        this.ip = clientIP;
        this.privateKey = privateKey;
        this.challenge = challenge;
        this.response = response;
    }

    private bool _errored;
    public bool IsErrored
    {
        get
        {
            return _errored;
        }
    }

    private Exception _ex;
    public Exception Exception
    {
        get
        {
            return _ex;
        }
    }

    private string _vr;
    public string ValidationResult
    {
        get
        {
            return _vr;
        }
    }

    public bool Validate()
    {
        try
        {
            string post = "privatekey=" + HttpUtility.UrlEncode(privateKey) + 
        "&remoteip=" + HttpUtility.UrlEncode(ip) + "&challenge=" + 
        HttpUtility.UrlEncode(challenge) + "&response=" + 
        HttpUtility.UrlEncode(response);

            WebRequest wr = HttpWebRequest.Create
            ("http://www.google.com/recaptcha/api/verify");
            wr.Method = "POST";

            if (proxy != null)
                wr.Proxy = proxy;

            wr.ContentLength = post.Length;
            wr.ContentType = "application/x-www-form-urlencoded";
            using (StreamWriter sw = new StreamWriter(wr.GetRequestStream()))
            {
                sw.Write(post);
                sw.Close();
            }

            HttpWebResponse resp = (HttpWebResponse)wr.GetResponse();
            using (StreamReader sr = new StreamReader(resp.GetResponseStream()))
            {
                string valid = sr.ReadLine();
                if (valid != null)
                {
                    if (valid.ToLower().Trim() == "false")
                    {
                        string errorcode = sr.ReadLine();

                        if (errorcode != null)
                        {
                            if (errorcode.ToLower().Trim() != "incorrect-captcha-sol")
                            {
                                _vr = errorcode;
                                _errored = true;
                                return false;
                            }
                        }
                    }

                    return (valid.ToLower().Trim() == "true");
                }
                else _vr = "empty web service response";

                sr.Close();
                return false;
            }
        }
        catch (Exception caught)
        {
            _errored = true;
            _ex = caught;
        }
        return false;
    }
}}

What am I doing wrong? Should I have to get a private key? Any help would be great.

Thanks in advance, Venkat.

Answer 1

It works with the public and private keys that I just created. Damn, I just assumed, "localhost" would not be accepted as a legal domain-name while signing up.