If the captcha has not been generated yet, there is no need to verify it via the server (and should not be able to submit form yet)

[sypets]

If the CAPTCHA response has not been created yet (e.g. response is ".FETCHING" for "friendly captcha"), there is no need to make a request to the captcha server. However the request is made and the message

Als Spam erkannt: 98% In dieser Nachricht könnte sich Spam befinden!

This message is cryptic for a user. The correct message would be e.g. "Please click on Anti-Robot verification" before submitting.

Better would be to not be able to submit the form until the field captcha is filled out.

There is a small window where this can happen, but difficult to reproduce (user clicks on submit before captcha is generated).

Possible solution

1. ideally, do not activate submit button until captcha generation is complete. This could be solved by having a minimum value in the input field for class "frc-captcha-solution" (for friendly captcah). Unfortunately, I don't know what possible values might be for the captcha method. But for friendly captcha, it looks like it must be a least 10 chars long. Unfortunately, this is handled in the JavaScript of the capcha supplier "friendly captcha". I have made a request there but we do not have a plan with support and I don't know if it will be followed up.

2. if the request has not been generated yet (e.g. empty or ".UNSTARTED" or ".FETCHING" or ...) in function CaptchaMethod::getCaptchaResponse

• do not make request to server
• show better error message, e.g. "you must click"

This would prevent unnecessary requests to the captcha server.

Friendly captcha

invalid:

• .UNSTARTED
• .UNFINISHED
• .FETCHING

I think it would help to set a minlength of 10 in input class="frc-captcha-solution" (will not work if value not changed by user, see mozilla docs for minlength)

[sypets]

proof of concept:

should work for "friendly captcha". This is just an example which will create a red border. Of course that is not the best solution and insufficient for color-blind. This will just add a visual hint but not prevent the submit button from being pressed before the captcha puzzle is complete.

Setting a minlength in the submit button will not work if the value is not set by the user, so this probably needs a JavaScript solution.

Constraint validation is only applied when the value is changed by the user.

https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/minlength

<style>
	div.frc-captcha:has(input.frc-captcha-solution[value=".UNSTARTED"]) { border: solid 3px red; }
        div.frc-captcha:has(input.frc-captcha-solution[value=".FETCHING"]) { border: solid 3px red; }
	div.frc-captcha:has(input.frc-captcha-solution[value=".UNFINISHED"]) { border: solid 3px red; }
</style>