BotDetect ASP.NET MVC Core 1/2 CAPTCHA Integration Quickstart

Unlike Recaptcha the Stalker -- BotDetect CAPTCHA works in China! Licensable source-code; self-hosted -- doesn't stalk -- nor does it slurp your form-data! Think: GDPR & LGPD!

Use THIS nuget in:

  • ASP.NET applications running on the legacy .NET (non-Core) Frameworks
  • ASP.NET Core applications running on the .NET Core Frameworks

1. Add CAPTCHA NuGet Package

  • Open the NuGet Package Manager.

    BotDetect ASP.NET Core Add Nuget Package
  • Choose package source and search for CAPTCHA.

    BotDetect ASP.NET Core Nuget Package Description

2. Configure Your ASP.NET Application

  • Add the highlighted lines into your app's Startup class (Startup.cs):
public class Startup
  public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)

    // configures Session middleware

    // configure your application pipeline to use Captcha middleware


  // This method gets called by the runtime. Use this method to add services to the container.
  public void ConfigureServices(IServiceCollection services)
    services.AddSingleton<IHttpContextAccessor, HttpContextAccessor>();

    services.AddMemoryCache(); // Adds a default in-memory 
                                        // implementation of 
                                        // IDistributedCache

    // Add framework services.

    // Add Session services.
    services.AddSession(options =>
      options.IdleTimeout = TimeSpan.FromMinutes(20);
      options.Cookie.IsEssential = true;
  • Add @addTagHelper directive makes Tag Helpers available to the view. To expose BotDetect Captcha Tag Helper in your project, you would use the following in Views/_ViewImports.cshtml file:

    @using AspNetMvc6BasicCaptchaExample
    @addTagHelper *, Microsoft.AspNetCore.Mvc.TagHelpers
    @addTagHelper "BotDetect.Web.Mvc.CaptchaTagHelper, BotDetect.Web.Mvc"

3. Show a Captcha Challenge on the Form

In View code: include BotDetect styles in page <head>, show Captcha challenge on the form using captcha tag helper:
@section header {
  <environment names="Development,Staging,Production">
      <link href="@BotDetect.Web.CaptchaUrls.Absolute.LayoutStyleSheetUrl"
            rel="stylesheet" type="text/css" />


<label asp-for="CaptchaCode">Retype the code from the picture:</label>
<captcha id="ExampleCaptcha" user-input-id="CaptchaCode" />
<div class="actions">
<input asp-for="CaptchaCode" />
<input type="submit" value="Validate" />
<span asp-validation-for="CaptchaCode"></span>
@if ((Context.Request.Method.ToUpper() == "POST") && ViewData.ModelState.IsValid)
  <span class="correct">Correct!</span>


4. Check User Input During Form Submission

Use the built-in Validate method of a MvcCaptcha instance.

In cases when a CaptchaControl instance is not available, use static Validate method of MvcCaptcha class.

using BotDetect.Web.Mvc;


public ActionResult ExampleAction(ExampleModel model)
  // init mvcCaptcha instance with captchaId
  MvcCaptcha mvcCaptcha = new MvcCaptcha("ExampleCaptcha");

  // get user input value
  string userInput = HttpContext.Request.Form["CaptchaCode"];

  // get validatingInstanceId from HttpContext.Request.Form
  string validatingInstanceId = HttpContext.Request.Form[mvcCaptcha.ValidatingInstanceKey];

  // or get validatingInstanceId from above mvcCaptcha instance
  //string validatingInstanceId = mvcCaptcha.WebCaptcha.ValidatingInstanceId;

  // call the built-in Validate method from above MvcCaptcha instance.
  if (mvcCaptcha.Validate(userInput, validatingInstanceId))
      // or you can use static Validate method of MvcCaptcha class 
      (i.e. MvcCaptcha.Validate("ExampleCaptcha", userInput, validatingInstanceId); )
      ModelState.AddModelError("CaptchaCode", "Incorrect!");
  return View(model);


In-Depth ASP.NET MVC CAPTCHA Instructions and Explanations

Detailed ASP.NET MVC Captcha instructions and explanations can be found in the ASP.NET MVC Captcha integration how to guide.

Other BotDetect ASP.NET CAPTCHA Quickstarts


ASP.NET Web Pages Basic CAPTCHA.