-
Notifications
You must be signed in to change notification settings - Fork 17
Description
From #50:
Hi there, Friendly Captcha engineer here 👋 one of our customers notified us about this pull request. I just wanted to point out that accepting a web user when the site verification request fails (in this scenario, returning
true) is our generally recommended approach—i.e., to "fail open".That way, issues with connecting to Friendly Captcha API servers or a misconfiguration in the request don't end up inadvertently blocking all users. This would be "fail closed" behavior.
Of course, the ultimate decision whether to fail open or fail closed is up to the implementor of the integration.
You can read a bit more about this recommendation here.
Originally posted by @greenberga in #50 (comment)
I think we had cases where misconfiguration failed open and lead to hard to spot errors during integration and test phase. Maybe we should have a "Test Connection" in the admin panel and later fail open in case of problems
Originally posted by @amenk in #50 (comment)