BotDetect ASP.NET MVC 4 CAPTCHA Integration Quickstart

documentation > asp.net captcha > asp.net mvc

C#
VB.NET

ASPX
Razor

1. Add a Reference to BotDetect

Both the BotDetect.dll and BotDetect.Web.Mvc.dll assemblies should be referenced. They are included in the BotDetect installation.

2. Show a Captcha Challenge on the Form

In View code: import the BotDetect namespace, include BotDetect styles in page <head>, create a MvcCaptcha object and pass it to the Captcha HtmlHelper:

<%@ Import Namespace="BotDetect.Web.Mvc" %> 

  […] 

  <link href="<%: Url.Content("~/" + BotDetect.Web.CaptchaUrls.LayoutStyleSheetUrl) %>" 
  rel="stylesheet" type="text/css" /> 
</head> 

  […] 
<% MvcCaptcha exampleCaptcha = new MvcCaptcha("ExampleCaptcha"); 
exampleCaptcha.UserInputID = "CaptchaCode"; %> 
<%: Html.Captcha(exampleCaptcha) %> 
@Html.TextBox("CaptchaCode")

3. Check User Input During Form Submission

Using CaptchaValidation Attribute
Using Validate method

Mark the protected Controller action with the CaptchaValidation attribute to include Captcha validation in ModelState.IsValid checks:

using BotDetect.Web.Mvc; 
  
  […] 

[HttpPost] 
[AllowAnonymous] 
[CaptchaValidation("CaptchaCode", "ExampleCaptcha", "Incorrect CAPTCHA code!")] 
public ActionResult ExampleAction(ExampleModel model) 
{ 
    if (!ModelState.IsValid) 
    {  
      // TODO: Captcha validation failed, show error message      
    }  
    else 
    {  
      // TODO: Captcha validation passed, proceed with protected action 
	MvcCaptcha.ResetCaptcha("ExampleCaptcha");		
    }

Use the built-in Validate method of a MvcCaptcha instance.

In cases when a CaptchaControl instance is not available, use static Validate method of MvcCaptcha class.

using BotDetect.Web.Mvc; 
  
  […] 

[HttpPost] 
[AllowAnonymous] 
public ActionResult ExampleAction(ExampleModel model) 
{ 
	// init mvcCaptcha instance with captchaId 
    MvcCaptcha mvcCaptcha = new MvcCaptcha("ExampleCaptcha"); 

    // get user input value 
    string userInput = HttpContext.Request.Form["CaptchaCode"]; 

    // get validatingInstanceId from HttpContext.Request.Form 
    string validatingInstanceId = HttpContext.Request.Form[mvcCaptcha.ValidatingInstanceKey]; 

    // or get validatingInstanceId from above mvcCaptcha instance 
    //string validatingInstanceId = mvcCaptcha.WebCaptcha.ValidatingInstanceId; 

    // call the built-in Validate method from above MvcCaptcha instance. 
    if (mvcCaptcha.Validate(userInput, validatingInstanceId)) 
    { 
        // or you can use static Validate method of MvcCaptcha class 
	(i.e. MvcCaptcha.Validate("ExampleCaptcha", userInput, validatingInstanceId); ) 
       MvcCaptcha.ResetCaptcha("ExampleCaptcha"); 
    } 
    else 
    { 
        ModelState.AddModelError("CaptchaCode", "Incorrect!"); 
    } 
    return View(model); 
	
}

4. Configure Your ASP.NET Application

Exclude BotDetect paths from ASP.NET MVC Routing:

public static void RegisterRoutes(RouteCollection routes) 
{ 
    routes.IgnoreRoute("{resource}.axd/{*pathInfo}"); 

    // BotDetect requests must not be routed 
    routes.IgnoreRoute("{*botdetect}", 
      new { botdetect = @"(.*)BotDetectCaptcha\.ashx" });

Update your application configuration (the web.config file):

<system.web> 
  <httpHandlers> 
    <!-- Register the HttpHandler used for BotDetect Captcha  
      requests --> 
    <add verb="GET" path="BotDetectCaptcha.ashx" 
      type="BotDetect.Web.CaptchaHandler, BotDetect"/> 
  </httpHandlers> 
  <!-- make sure Session State is enabled --> 
  <pages enableSessionState="true"> 
    <namespaces> 
      <add namespace="System.Web.Mvc" /> 
      <add namespace="System.Web.Mvc.Ajax" /> 
      <add namespace="System.Web.Mvc.Html" /> 
      <add namespace="System.Web.Routing" /> 
    </namespaces> 
  </pages> 
  <!-- Register a custom SessionIDManager for BotDetect Captcha  
    requests --> 
  <sessionState mode="InProc" cookieless="AutoDetect" timeout="20" 
    sessionIDManagerType="BotDetect.Web.CustomSessionIdManager, BotDetect"/> 
</system.web> 
<system.webServer> 
  <validation validateIntegratedModeConfiguration="false"/> 
  <handlers> 
    <!-- Register the HttpHandler used for BotDetect Captcha  
      requests (IIS 7.0+) --> 
    <remove name="BotDetectCaptchaHandler"/> 
    <add name="BotDetectCaptchaHandler" preCondition="integratedMode" 
      verb="GET" path="BotDetectCaptcha.ashx" 
      type="BotDetect.Web.CaptchaHandler, BotDetect"/> 
  </handlers> 
</system.webServer>

1. Add a Reference to BotDetect

Both the BotDetect.dll and BotDetect.Web.Mvc.dll assemblies should be referenced. They are included in the BotDetect installation.

2. Show a Captcha Challenge on the Form

In View code: import the BotDetect namespace, include BotDetect styles in page <head>, create a MvcCaptcha object and pass it to the Captcha HtmlHelper:

@using BotDetect.Web.Mvc; 

  […] 

  <link href="@BotDetect.Web.CaptchaUrls.Absolute.LayoutStyleSheetUrl" 
  rel="stylesheet" type="text/css" /> 
</head> 

  […] 
@{ MvcCaptcha exampleCaptcha = new MvcCaptcha("ExampleCaptcha"); 
exampleCaptcha.UserInputID = "CaptchaCode"; } 
@Html.Captcha(exampleCaptcha) 
@Html.TextBox("CaptchaCode")

3. Check User Input During Form Submission

Using CaptchaValidation Attribute
Using Validate method

Mark the protected Controller action with the CaptchaValidation attribute to include Captcha validation in ModelState.IsValid checks:

using BotDetect.Web.Mvc; 
  
  […] 

[HttpPost] 
[AllowAnonymous] 
[CaptchaValidation("CaptchaCode", "ExampleCaptcha", "Incorrect CAPTCHA code!")] 
public ActionResult ExampleAction(ExampleModel model) 
{ 
    if (!ModelState.IsValid) 
    {  
      // TODO: Captcha validation failed, show error message      
    }  
    else 
    {  
      // TODO: Captcha validation passed, proceed with protected action 
      MvcCaptcha.ResetCaptcha("ExampleCaptcha");  
    }

Use the built-in Validate method of a MvcCaptcha instance.

In cases when a CaptchaControl instance is not available, use static Validate method of MvcCaptcha class.

using BotDetect.Web.Mvc; 
  
  […] 

[HttpPost] 
[AllowAnonymous] 
public ActionResult ExampleAction(ExampleModel model) 
{ 
	// init mvcCaptcha instance with captchaId 
    MvcCaptcha mvcCaptcha = new MvcCaptcha("ExampleCaptcha"); 

    // get user input value 
    string userInput = HttpContext.Request.Form["CaptchaCode"]; 

    // get validatingInstanceId from HttpContext.Request.Form 
    string validatingInstanceId = HttpContext.Request.Form[mvcCaptcha.ValidatingInstanceKey]; 

    // or get validatingInstanceId from above mvcCaptcha instance 
    //string validatingInstanceId = mvcCaptcha.WebCaptcha.ValidatingInstanceId; 

    // call the built-in Validate method from above MvcCaptcha instance. 
    if (mvcCaptcha.Validate(userInput, validatingInstanceId)) 
    { 
        // or you can use static Validate method of MvcCaptcha class 
	(i.e. MvcCaptcha.Validate("ExampleCaptcha", userInput, validatingInstanceId); ) 
        MvcCaptcha.ResetCaptcha("ExampleCaptcha"); 
    } 
    else 
    { 
        ModelState.AddModelError("CaptchaCode", "Incorrect!"); 
    } 
    return View(model); 
	
}

4. Configure Your ASP.NET Application

Exclude BotDetect paths from ASP.NET MVC Routing:

public static void RegisterRoutes(RouteCollection routes) 
{ 
    routes.IgnoreRoute("{resource}.axd/{*pathInfo}"); 

    // BotDetect requests must not be routed 
    routes.IgnoreRoute("{*botdetect}", 
      new { botdetect = @"(.*)BotDetectCaptcha\.ashx" });

Update your application configuration (the web.config file):

<system.web> 
  <httpHandlers> 
    <!-- Register the HttpHandler used for BotDetect Captcha  
      requests --> 
    <add verb="GET" path="BotDetectCaptcha.ashx" 
      type="BotDetect.Web.CaptchaHandler, BotDetect"/> 
  </httpHandlers> 
  <!-- make sure Session State is enabled --> 
  <pages enableSessionState="true"> 
    <namespaces> 
      <add namespace="System.Web.Helpers" /> 
      <add namespace="System.Web.Mvc" /> 
      <add namespace="System.Web.Mvc.Ajax" /> 
      <add namespace="System.Web.Mvc.Html" /> 
      <add namespace="System.Web.Routing" /> 
      <add namespace="System.Web.WebPages" /> 
    </namespaces> 
  </pages> 
  <!-- Register a custom SessionIDManager for BotDetect Captcha  
    requests --> 
  <sessionState mode="InProc" cookieless="AutoDetect" timeout="20" 
    sessionIDManagerType="BotDetect.Web.CustomSessionIdManager, BotDetect"/> 
</system.web> 
<system.webServer> 
  <validation validateIntegratedModeConfiguration="false"/> 
  <handlers> 
    <!-- Register the HttpHandler used for BotDetect Captcha  
      requests (IIS 7.0+) --> 
    <remove name="BotDetectCaptchaHandler"/> 
    <add name="BotDetectCaptchaHandler" preCondition="integratedMode" 
      verb="GET" path="BotDetectCaptcha.ashx" 
      type="BotDetect.Web.CaptchaHandler, BotDetect"/> 
  </handlers> 
</system.webServer>

ASPX
Razor

1. Add a Reference to BotDetect

Both the BotDetect.dll and BotDetect.Web.Mvc.dll assemblies should be referenced. They are included in the BotDetect installation.

2. Show a Captcha Challenge on the Form

In View code: import the BotDetect namespace, include BotDetect styles in page <head>, create a MvcCaptcha object and pass it to the Captcha HtmlHelper:

<%@ Import Namespace="BotDetect.Web.Mvc" %> 

  […] 

  <link href="<%: Url.Content("~/" + BotDetect.Web.CaptchaUrls.LayoutStyleSheetUrl) %>" 
  rel="stylesheet" type="text/css" /> 
</head> 

  […] 
<% Dim exampleCaptcha As MvcCaptcha = New MvcCaptcha("ExampleCaptcha") 
exampleCaptcha.UserInputID = "CaptchaCode"%> 
<%: Html.Captcha(exampleCaptcha) %> 
<%: Html.TextBox("CaptchaCode") %>

3. Check User Input During Form Submission

Using CaptchaValidation Attribute
Using Validate method

Mark the protected Controller action with the CaptchaValidation attribute to include Captcha validation in ModelState.IsValid checks:

Imports System.Web.Mvc 
  
  […] 

<HttpPost()> _ 
<CaptchaValidation("CaptchaCode", "ExampleCaptcha", "Incorrect CAPTCHA Code!")> _ 
Public Function Index(ByVal model As ExampleModel) As ActionResult 
    If ModelState.IsValid Then 
      ' TODO: Captcha validation failed, show error message      

    Else 
      ' TODO: Captcha validation passed, proceed with protected action 
      MvcCaptcha.ResetCaptcha("ExampleCaptcha");

Use the built-in Validate method of a MvcCaptcha instance.

In cases when a CaptchaControl instance is not available, use static Validate method of MvcCaptcha class.

Imports System.Web.Mvc 
  
  […] 

<HttpPost()> _ 
Public Function Index(ByVal model As ExampleModel) As ActionResult 
	' init mvcCaptcha instance with captchaId 
	Dim mvcCaptcha = New MvcCaptcha("ExampleCaptcha") 

	' get user input value 
	Dim userInput As String = HttpContext.Request.Form("CaptchaCode") 

	' get validatingInstanceId from HttpContext.Request.Form 
	Dim validatingInstanceId As String = HttpContext.Request.Form(mvcCaptcha.ValidatingInstanceKey) 

	' or get validatingInstanceId from above mvcCaptcha instance 
	' Dim validatingInstanceId As String = mvcCaptcha.WebCaptcha.ValidatingInstanceId 

	' call the built-in Validate method from above MvcCaptcha instance. 
	If (mvcCaptcha.Validate(userInput, validatingInstanceId)) Then 

		' or you can use static Validate method of MvcCaptcha class (i.e. MvcCaptcha.Validate("ExampleCaptcha", userInput, validatingInstanceId); ) 
		mvcCaptcha.ResetCaptcha("ExampleCaptcha") 

	Else 

		ModelState.AddModelError("CaptchaCode", "Incorrect!") 
	End If 
	Return View(model)

Update your application configuration (the web.config file):

<system.web> 
  <httpHandlers> 
    <!-- Register the HttpHandler used for BotDetect Captcha  
      requests --> 
    <add verb="GET" path="BotDetectCaptcha.ashx" 
      type="BotDetect.Web.CaptchaHandler, BotDetect"/> 
  </httpHandlers> 
  <!-- make sure Session State is enabled --> 
  <pages enableSessionState="true"> 
    <namespaces> 
      <add namespace="System.Web.Mvc" /> 
      <add namespace="System.Web.Mvc.Ajax" /> 
      <add namespace="System.Web.Mvc.Html" /> 
      <add namespace="System.Web.Routing" /> 
    </namespaces> 
  </pages> 
  <!-- Register a custom SessionIDManager for BotDetect Captcha  
    requests --> 
  <sessionState mode="InProc" cookieless="AutoDetect" timeout="20" 
    sessionIDManagerType="BotDetect.Web.CustomSessionIdManager, BotDetect"/> 
</system.web> 
<system.webServer> 
  <validation validateIntegratedModeConfiguration="false"/> 
  <handlers> 
    <!-- Register the HttpHandler used for BotDetect Captcha  
      requests (IIS 7.0+) --> 
    <remove name="BotDetectCaptchaHandler"/> 
    <add name="BotDetectCaptchaHandler" preCondition="integratedMode" 
      verb="GET" path="BotDetectCaptcha.ashx" 
      type="BotDetect.Web.CaptchaHandler, BotDetect"/> 
  </handlers> 
</system.webServer>

1. Add a Reference to BotDetect

Both the BotDetect.dll and BotDetect.Web.Mvc.dll assemblies should be referenced. They are included in the BotDetect installation.

2. Show a Captcha Challenge on the Form

In View code: import the BotDetect namespace, include BotDetect styles in page <head>, create a MvcCaptcha object and pass it to the Captcha HtmlHelper:

@Imports BotDetect.Web.Mvc 

  […] 

  <link href="@BotDetect.Web.CaptchaUrls.Absolute.LayoutStyleSheetUrl" 
    rel="stylesheet" type="text/css" /> 
</head> 

  […] 
@Code Dim exampleCaptcha As MvcCaptcha = New MvcCaptcha("ExampleCaptcha") 
exampleCaptcha.UserInputID = "CaptchaCode" End Code 
@Html.Captcha(exampleCaptcha) 
@Html.TextBox("CaptchaCode")

3. Check User Input During Form Submission

Using CaptchaValidation Attribute
Using Validate method

Mark the protected Controller action with the CaptchaValidation attribute to include Captcha validation in ModelState.IsValid checks:

Imports System.Web.Mvc 
  
  […] 

<HttpPost()> _ 
<CaptchaValidation("CaptchaCode", "ExampleCaptcha", "Incorrect CAPTCHA Code!")> _ 
Public Function Index(ByVal model As ExampleModel) As ActionResult 
    If ModelState.IsValid Then 
      ' TODO: Captcha validation failed, show error message      

    Else 
      ' TODO: Captcha validation passed, proceed with protected action 
      MvcCaptcha.ResetCaptcha("ExampleCaptcha");

Use the built-in Validate method of a MvcCaptcha instance.

In cases when a CaptchaControl instance is not available, use static Validate method of MvcCaptcha class.

Imports System.Web.Mvc 
  
  […] 

<HttpPost()> _ 
Public Function Index(ByVal model As ExampleModel) As ActionResult 
	' init mvcCaptcha instance with captchaId 
	Dim mvcCaptcha = New MvcCaptcha("ExampleCaptcha") 

	' get user input value 
	Dim userInput As String = HttpContext.Request.Form("CaptchaCode") 

	' get validatingInstanceId from HttpContext.Request.Form 
	Dim validatingInstanceId As String = HttpContext.Request.Form(mvcCaptcha.ValidatingInstanceKey) 

	' or get validatingInstanceId from above mvcCaptcha instance 
	' Dim validatingInstanceId As String = mvcCaptcha.WebCaptcha.ValidatingInstanceId 

	' call the built-in Validate method from above MvcCaptcha instance. 
	If (mvcCaptcha.Validate(userInput, validatingInstanceId)) Then 

		' or you can use static Validate method of MvcCaptcha class (i.e. MvcCaptcha.Validate("ExampleCaptcha", userInput, validatingInstanceId); ) 
		mvcCaptcha.ResetCaptcha("ExampleCaptcha") 

	Else 

		ModelState.AddModelError("CaptchaCode", "Incorrect!") 
	End If 
	Return View(model)

4. Configure Your ASP.NET Application

Exclude BotDetect paths from ASP.NET MVC Routing:

Public Shared Sub RegisterRoutes(ByVal routes As RouteCollection) 
    routes.IgnoreRoute("{resource}.axd/{*pathInfo}") 

    ' BotDetect requests must not be routed 
    routes.IgnoreRoute("{*botdetect}", 
    New With {.botdetect = "(.*)BotDetectCaptcha\.ashx"})

Update your application configuration (the web.config file):

<system.web> 
  <httpHandlers> 
    <!-- Register the HttpHandler used for BotDetect Captcha  
      requests --> 
    <add verb="GET" path="BotDetectCaptcha.ashx" 
      type="BotDetect.Web.CaptchaHandler, BotDetect"/> 
  </httpHandlers> 
  <!-- make sure Session State is enabled --> 
  <pages enableSessionState="true"> 
    <namespaces> 
      <add namespace="System.Web.Helpers" /> 
      <add namespace="System.Web.Mvc" /> 
      <add namespace="System.Web.Mvc.Ajax" /> 
      <add namespace="System.Web.Mvc.Html" /> 
      <add namespace="System.Web.Routing" /> 
      <add namespace="System.Web.WebPages" /> 
    </namespaces> 
  </pages> 
  <!-- Register a custom SessionIDManager for BotDetect Captcha  
    requests --> 
  <sessionState mode="InProc" cookieless="AutoDetect" timeout="20" 
    sessionIDManagerType="BotDetect.Web.CustomSessionIdManager, BotDetect"/> 
</system.web> 
<system.webServer> 
  <validation validateIntegratedModeConfiguration="false"/> 
  <handlers> 
    <!-- Register the HttpHandler used for BotDetect Captcha  
      requests (IIS 7.0+) --> 
    <remove name="BotDetectCaptchaHandler"/> 
    <add name="BotDetectCaptchaHandler" preCondition="integratedMode" 
      verb="GET" path="BotDetectCaptcha.ashx" 
      type="BotDetect.Web.CaptchaHandler, BotDetect"/> 
  </handlers> 
</system.webServer>

In-Depth ASP.NET MVC CAPTCHA Instructions and Explanations

Detailed ASP.NET MVC Captcha instructions and explanations can be found in the ASP.NET MVC Captcha integration how to guide.

BotDetect ASP.NET MVC 4 CAPTCHA Integration Quickstart

1. Add a Reference to BotDetect

2. Show a Captcha Challenge on the Form

3. Check User Input During Form Submission

4. Configure Your ASP.NET Application

1. Add a Reference to BotDetect

2. Show a Captcha Challenge on the Form

3. Check User Input During Form Submission

4. Configure Your ASP.NET Application

1. Add a Reference to BotDetect

2. Show a Captcha Challenge on the Form

3. Check User Input During Form Submission

1. Add a Reference to BotDetect

2. Show a Captcha Challenge on the Form

3. Check User Input During Form Submission

4. Configure Your ASP.NET Application

In-Depth ASP.NET MVC CAPTCHA Instructions and Explanations

Other BotDetect ASP.NET CAPTCHA Quickstarts

Current BotDetect Versions

Popular Content

BotDetect Captcha Image Samples

BotDetect Audio Captcha Sound Samples