reCAPTCHA 企业评估 API 深入探讨

reCAPTCHA Enterprise 是 Google 的高级验证码服务，它通过详细的风险分析、评分原因、欺诈检测信号和帐户防护功能扩展了 reCAPTCHA v3。与仅返回分数和操作的标准免费版本不同，Enterprise 提供具有特定风险因素的可解释评估。本指南涵盖企业评估 API 架构、响应结构以及如何自动化处理受企业保护的站点。

企业版与标准版 reCAPTCHA

企业评估 API 流程

Client-side:

  1. Load reCAPTCHA Enterprise script
  2. Call grecaptcha.enterprise.execute(SITE_KEY, {action: 'LOGIN'})
  3. Receive token
  4. Send token to your backend

Server-side:

  1. Create assessment via Enterprise API
  2. Receive detailed risk analysis
  3. Make access decision based on score + reasons
  4. Optionally annotate the assessment (report fraud/legitimate)

客户端集成

JavaScript SDK

<script src="https://www.google.com/recaptcha/enterprise.js?render=SITE_KEY"></script>
<script>
    grecaptcha.enterprise.ready(function() {
        grecaptcha.enterprise.execute('SITE_KEY', { action: 'LOGIN' })
            .then(function(token) {
                // Send token to backend
                fetch('/api/verify', {
                    method: 'POST',
                    headers: { 'Content-Type': 'application/json' },
                    body: JSON.stringify({ token: token })
                });
            });
    });
</script>

与标准 reCAPTCHA v3 的主要区别：

• 脚本 URL 使用 .../recaptcha/enterprise.js 而不是 .../recaptcha/api.js
• API 对象是 grecaptcha.enterprise 而不是 grecaptcha
• execute() 返回相同的令牌格式

页面源中检测

import requests
import re

def detect_recaptcha_enterprise(url):
    """Detect if a page uses reCAPTCHA Enterprise."""
    html = requests.get(url, timeout=10).text

    indicators = {
        "is_enterprise": False,
        "is_standard": False,
        "site_key": None,
        "actions": [],
    }

    # Enterprise detection
    if "recaptcha/enterprise.js" in html:
        indicators["is_enterprise"] = True
        match = re.search(r"render=([A-Za-z0-9_-]+)", html)
        if match:
            indicators["site_key"] = match.group(1)

    # Standard v3 detection
    elif "recaptcha/api.js?render=" in html:
        indicators["is_standard"] = True
        match = re.search(r"render=([A-Za-z0-9_-]+)", html)
        if match:
            indicators["site_key"] = match.group(1)

    # Extract action names
    actions = re.findall(r"action:\s*['\"](\w+)['\"]", html)
    indicators["actions"] = list(set(actions))

    return indicators

print(detect_recaptcha_enterprise("https://staging.example.com/qa-login"))

服务器端评估API

创建评估 (Google Cloud API)

from google.cloud import recaptchaenterprise_v1
from google.cloud.recaptchaenterprise_v1 import Assessment

def create_assessment(project_id, site_key, token, action):
    """Create a reCAPTCHA Enterprise assessment."""
    client = recaptchaenterprise_v1.RecaptchaEnterpriseServiceClient()

    event = recaptchaenterprise_v1.Event()
    event.site_key = site_key
    event.token = token
    event.expected_action = action

    assessment = recaptchaenterprise_v1.Assessment()
    assessment.event = event

    request = recaptchaenterprise_v1.CreateAssessmentRequest()
    request.assessment = assessment
    request.parent = f"projects/{project_id}"

    response = client.create_assessment(request)
    return response

评估响应结构

{
    "name": "projects/123456/assessments/abcdef123",
    "event": {
        "token": "...",
        "siteKey": "6Le...",
        "expectedAction": "LOGIN",
        "hashedAccountId": "abc123..."
    },
    "riskAnalysis": {
        "score": 0.9,
        "reasons": [
            "AUTOMATION",
            "TOO_MUCH_TRAFFIC"
        ],
        "extendedVerdictReasons": [
            "BROWSER_ERROR"
        ]
    },
    "tokenProperties": {
        "valid": true,
        "hostname": "example.com",
        "action": "LOGIN",
        "createTime": "2025-01-15T10:30:00Z",
        "invalidReason": ""
    },
    "accountDefenderAssessment": {
        "labels": ["PROFILE_MATCH"]
    }
}

企业评分原因

Enterprise 提供了得分较低的具体原因：

扩展判决理由（附加细节）

账户卫士

Enterprise 的 Account Defender 在整个生命周期中跟踪用户帐户：

{
    "accountDefenderAssessment": {
        "labels": [
            "PROFILE_MATCH",
            "SUSPICIOUS_LOGIN_ACTIVITY",
            "SUSPICIOUS_ACCOUNT_CREATION",
            "RELATED_ACCOUNTS_NUMBER_HIGH"
        ]
    }
}

WAF集成

reCAPTCHA Enterprise 与 WAF 提供商集成，在网络边缘添加 CAPTCHA 挑战：

Cloudflare WAF 集成

Request arrives at Cloudflare edge
    ↓
Cloudflare WAF rule evaluates request
    ↓
Rule triggers reCAPTCHA Enterprise challenge
    ↓
Client solves CAPTCHA → token returned
    ↓
Cloudflare validates token via Enterprise API
    ↓
If valid + score above threshold → request forwarded to origin

F5 BIG-IP 集成

F5 iRule or policy evaluates request
    ↓
Triggers reCAPTCHA Enterprise challenge page
    ↓
Client solves → token validated server-side
    ↓
F5 forwards or blocks based on assessment score

自动化处理企业 reCAPTCHA

CaptchaAI 以与标准 reCAPTCHA 相同的方式解决 Enterprise 问题

从 API 求解器的角度来看，reCAPTCHA Enterprise 令牌的工作方式与标准 reCAPTCHA 令牌相同：

import requests
import time

API_KEY = "YOUR_API_KEY"

# Enterprise is solved with the same method
# The solver handles the Enterprise variant automatically
submit = requests.post("https://ocr.captchaai.com/in.php", data={
    "key": API_KEY,
    "method": "userrecaptcha",
    "googlekey": "6LcR_RsTAAAAAN_r0GEkGBfq3L7KmU5JbPHJtwNp",
    "pageurl": "https://enterprise-site.com/login",
    "enterprise": 1,  # Flag for Enterprise variant
    "json": 1,
})

task_id = submit.json()["request"]

for _ in range(60):
    time.sleep(5)
    result = requests.get("https://ocr.captchaai.com/res.php", params={
        "key": API_KEY,
        "action": "get",
        "id": task_id,
        "json": 1,
    }).json()

    if result.get("status") == 1:
        token = result["request"]
        print(f"Enterprise token: {token[:50]}...")
        break

Node.js

const axios = require("axios");

async function solveEnterprise(sitekey, pageurl) {
    const API_KEY = "YOUR_API_KEY";

    const { data: submit } = await axios.post(
        "https://ocr.captchaai.com/in.php",
        new URLSearchParams({
            key: API_KEY,
            method: "userrecaptcha",
            googlekey: sitekey,
            pageurl: pageurl,
            enterprise: 1,
            json: 1,
        })
    );

    const taskId = submit.request;

    for (let i = 0; i < 60; i++) {
        await new Promise(r => setTimeout(r, 5000));
        const { data: result } = await axios.get(
            "https://ocr.captchaai.com/res.php",
            { params: { key: API_KEY, action: "get", id: taskId, json: 1 } }
        );

        if (result.status === 1) return result.request;
    }

    throw new Error("Timeout");
}

如何在目标页面上检测企业版与标准版

def identify_recaptcha_version(html):
    """Determine which reCAPTCHA version a page uses."""
    if "recaptcha/enterprise.js" in html:
        return "enterprise"
    elif "recaptcha/api.js?render=" in html:
        return "v3"
    elif "g-recaptcha" in html and 'data-size="invisible"' in html:
        return "v2_invisible"
    elif "g-recaptcha" in html:
        return "v2"
    else:
        return "none"

企业故障排除

常见问题

reCAPTCHA Enterprise 是否比标准 reCAPTCHA 更难解决？

令牌生成过程是相同的。 Enterprise 添加了服务器端分析功能（分数原因、Account Defender），但客户端挑战是相同的。 API 求解器为 Enterprise 生成令牌的方式与为标准版本生成令牌的方式相同。

我是否需要 Google Cloud 帐户来解决企业验证码？

不需要。作为在目标网站上解决企业验证码的自动化开发人员，您只需要页面中的 sitekey 和 CaptchaAI 等 API 求解器。网站运营商需要 Google Cloud 帐户来验证评估，而不是 CAPTCHA 求解器。

如何判断网站使用的是企业版还是标准版 reCAPTCHA？

检查脚本 URL。企业版使用 recaptcha/enterprise.js，标准版使用 recaptcha/api.js。 JavaScript API 对象名称也有所不同：grecaptcha.enterprise.execute() 与 grecaptcha.execute()。

Enterprise 评分原因可以用来提高我的自动化程度吗？

如果您操作目标站点（测试您自己的验证码实施），是的 - 原因会告诉您触发了哪些检测信号。如果您在第三方网站上解决验证码，则您看不到原因 - 只有网站运营商可以看到它们。

概括

reCAPTCHA Enterprise 通过详细的风险分析、评分原因、Account Defender 和 WAF 集成扩展了标准 reCAPTCHA。从自动化的角度来看，企业验证码的解决方式与标准 reCAPTCHA 相同 - 将 enterprise=1 参数添加到您的CaptchaAIAPI 请求。通过检查页面源中的 recaptcha/enterprise.js 来检测 Enterprise。关键的操作差异是确保您传递正确的 enterprise 标志和匹配的 action 参数。

相关文章

• 如何使用Api解决Recaptcha V2回调
• Recaptcha V2 Turnstile同一站点处理
• 如何使用Api解决Recaptcha V3 Enterprise