# captcha_failed

The request carried no captcha solution, or one that is wrong, expired or used (400).

## Meaning

Registration, every request for an emailed link (password reset, a new verification
link), and sign-in after `auth.captcha.sign_in_after` recent failures for the
address or the IP, need a solved captcha from `GET /v1/auth/captcha`. Each solution
is single use and expires after `auth.captcha.altcha.validity` (default `5m`) with
the built-in provider.

## Impact

The user is asked to solve a new challenge. Occasional failures are expected: a page
left open past the validity, or a double submit. Every user failing means the page
and the server disagree about the provider or its keys.

## Diagnosis

1. Look the request id up on the Troubleshooting page. The refusal is recorded on
   the action it guarded (for example `auth.sign_in.completed`) with reason
   `access_denied` and cause `captcha_missing`, `captcha_invalid`,
   `captcha_expired` or `captcha_replayed`.
2. All `captcha_invalid` with a hosted provider: check `auth.captcha.provider`,
   `auth.captcha.site_key` and `auth.captcha.secret` belong to the same site.

## Mitigation

- As a user: solve the new challenge and submit once.
- As an operator: match the provider keys; raise `auth.captcha.altcha.validity` if
  users take longer than it allows.

## Escalation

Escalate when solved captchas are refused for everyone with a correct configuration.
Open an issue with request ids, the audit causes, the provider and the server
version. Never attach the captcha secret.

---

[Problem code runbooks](https://www.nauthera.io/docs/v1/runbooks/problems) · Generated from [`internal/runbook/problems.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/problems.yaml) in nauthera-server.