Load recaptcha related files on focus of the form fields. - #6
Merged
Conversation
rhoerr
reviewed
Feb 27, 2026
Contributor
|
Thanks for submitting this. Just saw it now. We can merge once the trailing spaces are fixed. |
Contributor
|
Per https://discord.com/channels/893449664093904936/1483402749419847803, this changeset breaks recaptcha for iframes, which never see focus (for instance, Braintree's hosted payment fields). We will have to either improve it (Vinai suggested loading on idle) or revert. We'll decide and make a release in the very near future as this is a checkout-breaking issue for those it affects. |
rhoerr
added a commit
that referenced
this pull request
Mar 18, 2026
The focus-based deferral from #6 ran in initialize() before KnockoutJS rendered the template, so the DOM query for the parent form always returned empty — the focus listener never attached. Additionally, iframe-embedded payment fields (e.g. Braintree hosted fields) never fire focus events on the parent form, so reCAPTCHA never loaded for those checkout flows. Move the deferred load into renderReCaptcha() (called from KO afterRender) where the DOM actually exists: - Focus on any form field triggers an eager API load - requestIdleCallback (capped at 3s) or setTimeout(1s) fallback ensures the API loads for iframes and no-focus scenarios - When no parent form is found, fall back to immediate load instead of silently deadlocking - Use $(window).one() for the recaptchaapiready listener to prevent handler accumulation on repeated renderReCaptcha calls Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
7 tasks
rhoerr
added a commit
that referenced
this pull request
Mar 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Original PR magento/security-package/pull/334
Description (*)
reCaptcha remote files will be loaded only if customer (visitor) focus on the fields for the form for which reCaptcha is enabled. This will reduce loaded files and immediately reflects to loading time.
Fixed Issues (if relevant)
Fixes magento/security-package#333
Fixes magento/magento2#38303
Manual testing scenarios (*)
Enable reCaptcha (no matter which version) for Newsletter, Contact Form, Review, Registration or ... anything.
Load the page which will contains form for which reCaptcha is enabled (Ex. Contact form /contact)
ReCaptcha external (gstatic.com) files will not be loaded (you will not see the logo of the recaptcha or loaded files in the network tab of the browser developer inspector).
Click on the first or random field (Ex. Name)
Recaptcha files will be loaded and you will see logo of the repCaptcha somewhere on the page as you are configured in the step 1.
Questions or comments
Contribution checklist (*)