- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
3 weeks ago
I have a requirement to add a google reCAPTCHA widget that can be called via a custom variable which is added to the record producer.
So far I have managed to get the public widget created and loading a google reCAPTCHA but it is only working on authenticated forms.
I have provided screenshots for context of where I have got to...
1) Custom variable calling the widget
2) REST Message for the siteverify
3) script include to verify reCAPTCHA tokens
<div>
<form ng-submit="c.submitV2Request()">
<div id="recaptcha_container"></div>
<br>
<input class="btn btn-primary" type="submit" value="Submit reCAPTCHA">
</form>
</div>
server script:
Client controller:
Link:
5) Angular Provider
Solved! Go to Solution.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
a week ago
After reviewing my development with ServiceNow.
We'd found that we needed to swap the variable type to something else, i.e., multi-line text this will then display the write and read role permissions fields, you need to add 'public' role to those fields save the record and then change the variable type back to custom and re save the record. This will keep the permissions added. I also changed my code to be similar to the following post - https://www.google.com/url?q=https://www.servicenow.com/community/user-group-info/how-to-add-recaptc...
As this was the exact way I wanted my reCAPTCHA widget to work, rather than having a submit button and also preventing the submission of the public record producers without having the reCAPTCHA confirmed.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
2 weeks ago
You've done most of the hard work already. Your widget and REST call work for logged-in users, so the problem is almost certainly about guest access. Start by finding out exactly what breaks for a guest, because each cause has a different fix.
- Open your public portal in a private browser window so you're truly logged out.
- Open the record producer and press F12 to see the browser console.
- Note whether the reCAPTCHA box doesn't appear at all, or appears but fails when you verify.
- Go to System Logs > All and search for messages starting with "GoogleRecaptcha ::", which your script include writes when the call fails.
If the box doesn't appear at all, the guest probably can't load the widget, the page, or the item.
- Go to Service Portal > Widgets, open your reCAPTCHA widget, and confirm the Public checkbox is ticked.
- Go to Service Portal > Pages, open the page your form uses (usually sc_cat_item), and confirm it's marked Public too.
- Open the record producer and check its Available For list. Guests need user criteria that lets them see the item.
- Open the custom variable and check the Read, Write, and Create roles on the Permissions tab. Clear any roles there, since guests have none.
- Check the Angular Provider is in the widget's Angular Providers related list. A missing one shows an "Unknown provider" error in the console.
If the box shows "Invalid domain for site key," Google is rejecting your public URL. This happens when your public portal uses a different domain from the logged-in one.
- Open your Google reCAPTCHA admin console.
- Add the exact domain your public portal uses to the allowed domains list.
If the box shows but verification fails, the guest session may not be reading your keys.
- Add gs.info('site key: ' + gcSiteKey); to your widget server script and test as a guest.
- If the key comes back empty, open the properties google.captcha.site_key and google.captcha.secret and clear any Read roles.
I'm not fully certain property read roles affect server-side reads in every release, so test this rather than assume it.
There's also a small bug in your client controller. Your check says recaptchaV2WidgetId === null && recaptchaV2WidgetId === false, which can never be true.
- Change the && to || so your "Recaptcha not setup" message can fire.
- Remove the <form> tag from your widget HTML. Your widget sits inside the catalog form, and a form inside a form causes odd submits.
- Replace the submit input with a button using ng-click="c.submitV2Request()".
The biggest gap is that your captcha isn't tied to the record producer's Submit button yet. A guest can skip your widget button and just submit the form, so the captcha protects nothing right now.
- Add a hidden single line text variable to the record producer, named something like recaptcha_token.
- In your getV2Result callback, store the token with $scope.page.g_form.setValue('recaptcha_token', result);.
- Clear that variable in your expired callback so an old token doesn't linger.
- Add an onSubmit catalog client script that blocks submit if recaptcha_token is empty.
- In the record producer's Script field, call new GoogleRecaptcha().verify(producer.recaptcha_token).
- If it returns false, call current.setAbortAction(true) and add an error message so no record is created.
- Remove the separate verify call from your widget button, because Google tokens work only once.
- Test the full flow as a guest and as a logged-in user in a sub-production instance before moving your update set.
If none of this fixes it, share your release name and the exact console error, and that should point straight to the cause.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
a week ago
After reviewing my development with ServiceNow.
We'd found that we needed to swap the variable type to something else, i.e., multi-line text this will then display the write and read role permissions fields, you need to add 'public' role to those fields save the record and then change the variable type back to custom and re save the record. This will keep the permissions added. I also changed my code to be similar to the following post - https://www.google.com/url?q=https://www.servicenow.com/community/user-group-info/how-to-add-recaptc...
As this was the exact way I wanted my reCAPTCHA widget to work, rather than having a submit button and also preventing the submission of the public record producers without having the reCAPTCHA confirmed.

