How To Add BotDetect CAPTCHA Protection to Spring MVC Forms

Protecting your Spring MVC forms with BotDetect Java Captcha requires a few steps, outlined on this page.

You can also see how BotDetect Captcha protection has been added to various kinds of Spring MVC forms and projects by running the BotDetect Captcha Spring integration code examples coming with the BotDetect installation. You can also reuse the code example source code that fits your requirements.

CAPTCHA Integration Steps

To add BotDetect Captcha protection to a Spring MVC application:

• Include BotDetect library in the classpath
• Register CaptchaServlet
• Display Captcha protection on the Spring MVC form
• Validate Captcha user input during Spring MVC form submission

Include BotDetect Library in the Classpath

BotDetect Captcha can simply be included in classpath by copying botdetect.jar from the BotDetect Java download package.

To protect specific application with BotDetect Captcha copy botdetect.jar into WEB-INF/lib directory of your application.

Copy botdetect.jar into lib directory of your web container or application server's domain in order to share BotDetect Captcha among multiple applications.

[back to the top of the page]

Register CaptchaServlet

Update your application configuration (web.xml) file.

<servlet-name>BotDetect Captcha</servlet-name>
    <servlet-class>botdetect.web.http.CaptchaServlet</servlet-class>
</servlet>
<servlet-mapping>
    <servlet-name>BotDetect Captcha</servlet-name>
    <url-pattern>/botdetectcaptcha</url-pattern>
</servlet-mapping>  

[back to the top of the page]

Display Captcha Protection on the Spring MVC Form

We'll assume you already have a form which can be posted (<form method="post" ...), with other fields in place.

BotDetect custom captcha tag is designed to add CAPTCHA protection to Spring MVC form as simple as possible.

At the top of the file put BotDetect taglib declaration:

<%@taglib prefix="botDetect" uri="botDetect"%>

To display the Captcha test on your form, you will need the following Html elements:

• A textbox for the Captcha code user input, with a label displaying Captcha instructions
• The Captcha markup including the image, sound and reload icons etc., which will be generated by the Captcha tag.

For example:

<botDetect:captcha id="basicExampleCaptcha"/>
<div class="validationDiv">
    <input id="captchaCodeTextBox" type="text"
           name="captchaCodeTextBox" value="${basicExample.captchaCodeTextBox}"/>
    <input type="submit" name="submit" value="Submit" />&nbsp;
    <span class="correct">${basicExample.captchaCodeCorrect}</span>
    <span class="incorrect">${basicExample.captchaCodeIncorrect}</span>
</div>

[back]

When you open your form in a browser, the above declarations should render as:

If you are adding Captcha protection to multiple Spring MVC forms in the same website, you should initialize each Captcha object with unique name (e.g. "registrationCaptcha", "commentCaptcha", ...).

[back to the top of the page]

Validate Captcha User Input During Spring MVC Form Submission

Since we want to ensure only real human users can perform a certain action (e.g. account registration or comment submission), we also have to add Captcha validation code which will process form submissions, and only allow certain actions if Captcha validation succeeds.

Add CAPTCHA Validation Logic to Spring MVC Controller

When the form is submitted, the Captcha validation result must be checked and the protected action (user registration, comment posting, email sending, ...) only performed if the Captcha test was passed. You just have to create Captcha object instance with the same name as the one used on the form first. For example, this code should be part of or invoked from controller's onSubmit method:

Captcha captcha = Captcha.load(request, "basicExampleCaptcha");
boolean isHuman = captcha.validate(request, basicExample.getCaptchaCodeTextBox());
if (isHuman) {
  // TODO: Captcha validation passed, perform protected action
} else {
  // TODO: Captcha validation failed, show error message
}
return new ModelAndView("index", "basicExample", basicExample);

This approach is shown in the BotDetect Spring MVC Basic CAPTCHA integration code example included in the BotDetect download package.

[back to the top of the page]