How To Add BotDetect CAPTCHA Protection to JSF Forms

Unlike Recaptcha the Stalker -- BotDetect CAPTCHA works in China! Licensable source-code; self-hosted -- doesn't stalk -- nor does it slurp your form-data! Think: GDPR & LGPD!

Protecting your JSF forms with BotDetect Java Captcha slightly differs from JavaServer Pages protection but is still straightforward whether you use standard or Facelets presentation technology.

You can also see how BotDetect Captcha protection has been added to various kinds of JSF forms and projects by running the BotDetect Captcha JSF integration code examples coming with the BotDetect installation. You can also reuse the code example source code that fits your requirements.

Here we will discuss only integration steps which differ from JavaServer Pages integration steps since including BotDetect Library in the Classpath and registering CaptchaServlet steps are the same regardless of framework.

Add BotDetect Java CAPTCHA Library Dependency

Here is how to add BotDetect Java CAPTCHA Library dependency in various dependency management scenarios:

Install BotDetect Java CAPTCHA dependencies

The free version Maven artifacts are available from our public repository; while the enterprise version jars are available in the root folder of the enterprise version's archive.

To reference the BotDetect dependency from our public repository, the repository itself has to be declared first -- add the highlighted lines to your app's pom.xml file:

<repository>
  <id>captcha</id>
  <name>BotDetect Captcha Repository</name>
  <url>https://git.captcha.com/botdetect-java-captcha.git/blob_plain/HEAD:/</url>
</repository>

Then, in the same file, declare the BotDetect dependency, too:

<dependency>
  <groupId>com.captcha</groupId>
  <artifactId>botdetect-jsf20</artifactId>
  <version>4.0.beta3.7</version>
</dependency>

[back to the top of the page]

Register CaptchaServlet

Update your application configuration (web.xml) file. 

<servlet>
  <servlet-name>BotDetect Captcha</servlet-name>
  <servlet-class>com.captcha.botdetect.web.servlet.CaptchaServlet</servlet-class>
</servlet>
<servlet-mapping>
  <servlet-name>BotDetect Captcha</servlet-name>
  <url-pattern>/botdetectcaptcha</url-pattern>
</servlet-mapping>

[back to the top of the page]

BotDetect CAPTCHA JSF Tag

To protect your JSF form use dedicated jsfCaptcha tag.
Adding jsfCaptcha tag to JSF form is pretty straightforward but there are some differences between standard JSF (.jsp) and Facelets (.xhtml) presentation technologies:

  • declare taglib at the beginning of the .jsp file:
    • <%@taglib prefix="botDetect" uri="https://captcha.com/java/jsf"%>
  • add attribute prependId="false" to <h:form> opening tag
    this is not mandatory but enables some added functionality to jsfCaptcha tag
  • within the form insert:
    • <h:outputLabel for="captchaCode" 
  value="Retype the characters from the picture:"/>
  
<botDetect:jsfCaptcha id="exampleCaptcha" 
                      userInputID="captchaCode"
                      binding="#{captchaExampleBean.captcha}"/>
                      
<h:inputText id="captchaCode" value="#{captchaExampleBean.captchaCode}"/>

[back]

When you open your form in a browser, the above declarations should render as:

BotDetect CAPTCHA added to an JSP page

If you are adding Captcha protection to multiple JSF forms in the same website, you should take care to give each one a unique name (e.g. "registrationCaptcha", "commentCaptcha", ...) in the Captcha object constructor.

In order to perform CAPTCHA validation jsfCaptcha tag must be bound with the corresponding property of the backing bean. This backing bean property should be of the JsfCaptcha type, and include both getter and setter access:

import botdetect.web.jsf.JsfCaptcha;
  [...]

private JsfCaptcha captcha;
  [...]

public JsfCaptcha getCaptcha() {
   return captcha;
}

public void setCaptcha(JsfCaptcha captcha) {
   this.captcha = captcha;
}

[back to the top of the page]

Check is the Visitor a Human on Form PostBack

Once the Captcha challenge is displayed on your form, the code processing form submissions can check if the Captcha was solved successfully and deny access to bots.

Add CAPTCHA Validation Logic to Backing Bean

When the form is submitted, the Captcha validation result must be checked and the protected action (user registration, comment posting, email sending, ...) only performed if the Captcha test was passed. For example, this code should be part of or invoked from backing bean method declared in <form> action attribute:

boolean isHuman = captcha.validate(captchaCode);
if (isHuman) {
  correctLabelVisible = true;
  incorrectLabelVisible = false;
} else {
  correctLabelVisible = false;
  incorrectLabelVisible = true;
}

[back to the top of the page]


Please Note

BotDetect Java Captcha Library v4.0.Beta3.7 is an in-progress port of BotDetect 4 Captcha, and we need you to guide our efforts towards a polished product. Please let us know if you encounter any bugs, implementation issues, or a usage scenario you would like to discuss.

© Captcha, Inc. 2004-2023. All rights reserved.

BotDetect, BotDetect CAPTCHA, Lanap, Lanap CAPTCHA, Lanap BotDetect, Lanap BotDetect CAPTCHA, Lanapsoft, Lanapsoft CAPTCHA, Lanapsoft BotDetect, Lanapsoft BotDetect CAPTCHA, and Lanap Software are trademarks of Captcha, Inc. All other product, brand, and company names are mentioned for identification purposes only and are trademarks or registered trademarks of their respective owners.

Captcha, Inc. -- formerly: Lanapsoft, Inc. / Lanap, Inc.