title: Google reCAPTCHA response success: false, no error codes
body: <p>UPDATE: Google has <a href="https://groups.google.com/d/msg/recaptcha/THvvdHPoEHE/Y07xNeJHBQAJ" rel="nofollow noreferrer">recently updated their error message</a> with an additional error code possibility: "timeout-or-duplicate". </p>
  
  <p>This new error code seems to cover 99% of our previously mentioned mysterious 
  cases.</p>
  
  <p>We are still left wondering why we get that many validation requests that are either timeouts or duplicates. Determinining this with certainty is likely to be impossible, but now I am just hoping that someone else has experienced something like it.</p>
  
  <hr>
  
  <p>Disclaimer: I cross posted this <a href="https://groups.google.com/forum/#!topic/recaptcha/1tBg-MNyGMY" rel="nofollow noreferrer">to Google Groups</a>, so apologies for spamming the ether for the ones of you who frequent both sites.</p>
  
  <p>I am currently working on a page as part of a ASP.Net MVC application with a form that uses reCAPTCHA validation. The page currently has many daily users.
  In my server side validation** of a reCAPTCHA response, for a while now, I have seen the case of the reCAPTCHA response having its success property set to false, but with an accompanying empty error code array.
  Most of the requests pass validation, but some keep exhibiting this pattern.</p>
  
  <p>So after doing some research online, I explored the two possible scenarios I could think of: </p>
  
  <ol>
  <li>The validation has timed out and is no longer valid.</li>
  <li>The user has already been validated using the response value, so they are rejected the second time.</li>
  </ol>
  
  <p>After collecting data for a while, I have found that all cases of "Success: false, error codes: []" have either had the validation be rather old (ranging from 5 minutes to 10 days(!)), or it has been a case of a re-used response value, or sometimes a combination of the two.
  Even after implementing client side prevention of double-clicking my submit-form button, a lot of double submits still seem to get through to the server side Google reCAPTCHA validation logic.</p>
  
  <p>My data tells me that 1.6% (28) of all requests (1760) have failed with at least one of the above scenarios being true ("timeout" or "double submission").
  Meanwhile, not a single request of the 1760 has failed where the error code array was not empty.</p>
  
  <p>I just have a hard time imagining a practical use case where a ChallengeTimeStamp gets issued, and then after 10 days validation is attempted, server side.</p>
  
  <p>My question is:</p>
  
  <p>What could be the reason for a non-negligible percentage of all Google reCAPTCHA server side validation attempts to be either very old or a case of double submission?</p>
  
  <p>**By "server side validation" I mean logic that looks like this:</p>
  
  <pre><code>    public bool IsVerifiedUser(string captchaResponse, string endUserIp)
      {            
          string apiUrl = ConfigurationManager.AppSettings["Google_Captcha_API"];
          string secret = ConfigurationManager.AppSettings["Google_Captcha_SecretKey"];
          using (var client = new HttpClient())
          {
              var parameters = new Dictionary&lt;string, string&gt;
              {
                  { "secret", secret },
                  { "response", captchaResponse },
                  { "remoteip", endUserIp },
              };
              var content = new FormUrlEncodedContent(parameters);
              var response = client.PostAsync(apiUrl, content).Result;                
              var responseContent = response.Content.ReadAsStringAsync().Result;
              GoogleCaptchaResponse googleCaptchaResponse = JsonConvert.DeserializeObject&lt;GoogleCaptchaResponse&gt;(responseContent);
  
              if (googleCaptchaResponse.Success)
              {
                  _dal.LogGoogleRecaptchaResponse(endUserIp, captchaResponse);
                  return true;
              }
              else 
              {
                 //Actual code ommitted
                     //Try to determine the cause of failure
                     //Look at googleCaptchaResponse.ErrorCodes array (this has been empty in all of the 28 cases of "success: false")
                     //Measure time between googleCaptchaResponse.ChallengeTimeStamp (which is UTC) and DateTime.UtcNow
                     //Check reCAPTCHAresponse against local database of previously used reCAPTCHAresponses to detect cases of double submission
                 return false;
              }
          }
     }
  </code></pre>
  
  <p>Thank you in advance to anyone who has a clue and can perhaps shed some light on the subject.</p>