title: Google reCAPTCHA: How to get user response and validate in the server side?
body: <p>I am doing a Java (JSP + Servlet) web application (I understand that this question is technology-independent). I hope to use the latest Google reCAPTCHA service.</p>
  <p>I am playing with a Google reCAPTCHA example found here:</p>
  <p><a href="https://developers.google.com/recaptcha/docs/display#config" rel="noreferrer">https://developers.google.com/recaptcha/docs/display#config</a></p>
  <pre><code>&lt;html&gt;
    &lt;head&gt;
      &lt;title&gt;reCAPTCHA demo: Simple page&lt;/title&gt;
       &lt;script src=&quot;https://www.google.com/recaptcha/api.js&quot; async defer&gt;&lt;/script&gt;
    &lt;/head&gt;
    &lt;body&gt;
      &lt;form action=&quot;?&quot; method=&quot;POST&quot;&gt;
        &lt;div class=&quot;g-recaptcha&quot; data-sitekey=&quot;my_site_key&quot;&gt;&lt;/div&gt;
        &lt;br/&gt;
        &lt;input type=&quot;submit&quot; value=&quot;Submit&quot;&gt;
      &lt;/form&gt;
    &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  <p>I am able to see the displayed recaptcha image as follows:</p>
  <p><img src="https://i.stack.imgur.com/7CLJo.png" alt="enter image description here" /></p>
  <p>When I check &quot;I'm not a robot&quot;, I get the following:</p>
  <p><img src="https://i.stack.imgur.com/V53IO.png" alt="enter image description here" /></p>
  <p>As you can see, there is a Verify button and based on my tests, user response is sent to Google for verification.</p>
  <p>How can I get the user response so that I can verify user response in my own backend code (as suggested by Google at <a href="https://developers.google.com/recaptcha/docs/verify" rel="noreferrer">https://developers.google.com/recaptcha/docs/verify</a>).</p>
  <pre><code>g-recaptcha-response POST parameter when the user submits the form on your site
  </code></pre>
  <p>On the server side, I can, by clicking on the &quot;Submit&quot; button, get user input from parameter &quot;g-recaptcha-response&quot; only when a user is verified successfully with Google first. Otherwise, &quot;g-recaptcha-response&quot; is blank on the server side. This means that I can do server-side verification only after the client-side's verification success. If so, what is the point of doing another verification on the server-side, which is the option provided by Google reCAPTHA?</p>
  <p>Do I miss anything?</p>