BuildingBlocks.Security.BotProtection

public async Task ValidateAsync(string token, string expectedAction, CancellationToken ct = default)
{
    if (string.IsNullOrWhiteSpace(token))
        throw new RecaptchaValidationException("Recaptcha token gerekli.");

    var content = new FormUrlEncodedContent(new Dictionary<string, string>
    {
        ["secret"]   = _options.SecretKey,
        ["response"] = token
    });

    var response = await _httpClient.PostAsync(
        "https://www.google.com/recaptcha/api/siteverify", content, ct);
    var result = JsonSerializer.Deserialize<RecaptchaResponse>(
        await response.Content.ReadAsStringAsync(ct));

    if (result is null || !result.Success)
        throw new RecaptchaValidationException("Recaptcha doğrulaması başarısız oldu.");
    if (result.Score < _options.ScoreThreshold)
        throw new RecaptchaValidationException($"Recaptcha puanı çok düşük: {result.Score}");
    if (!string.Equals(result.Action, expectedAction, StringComparison.Ordinal))
        throw new RecaptchaValidationException("Recaptcha işlemi uyuşmazlığı.");
    if (_options.ValidateHostname &&
        !_options.AllowedHostnames.Contains(result.Hostname, StringComparer.OrdinalIgnoreCase))
        throw new RecaptchaValidationException("Hostname mismatch.");
}

{
  "Recaptcha": {
    "SecretKey": "6Lc...secret",
    "ScoreThreshold": 0.6,
    "ValidateHostname": true,
    "AllowedHostnames": ["app.example", "www.example"]
  }
}

public static IServiceCollection AddRecaptcha(this IServiceCollection services, IConfiguration configuration)
{
    services.Configure<RecaptchaOptions>(configuration.GetSection("Recaptcha"));

    services.AddHttpClient<IRecaptchaValidator, GoogleRecaptchaValidator>(client =>
        {
            client.Timeout = TimeSpan.FromSeconds(5);
        })
        .AddTransientHttpErrorPolicy(policy =>
            policy.WaitAndRetryAsync(3, _ => TimeSpan.FromMilliseconds(200)));

    return services;
}

public class SubmitContactFormCommandHandler(IRecaptchaValidator recaptcha)
    : IRequestHandler<SubmitContactFormCommand, Unit>
{
    public async Task<Unit> Handle(SubmitContactFormCommand request, CancellationToken ct)
    {
        // expectedAction frontend'deki grecaptcha.execute({ action: "contact" }) ile eşleşmeli
        await recaptcha.ValidateAsync(request.RecaptchaToken, expectedAction: "contact", ct);

        // doğrulama geçtiyse iş mantığı...
        return Unit.Value;
    }
}