cli: `theme dev` doesn't support captcha on customer login page

Issue summary

When Captcha support is enabled, browsing to http://127.0.0.1:9292/account/login will sometimes trigger the captcha. Submitting the captcha on http://127.0.0.1:9292/challenge just redirects back to the same page.

See https://community.shopify.com/c/online-store-2-0/unable-to-log-into-customer-account-when-using-shopify-theme/m-p/1343096/highlight/false#M1414

Expected behavior

Solving the captcha should log you in as a customer.

Actual behavior

It just circles back to http://127.0.0.1:9292/challenge.

Tip: include an error message (in a <details></details> tag) if your issue is related to an error

Steps to reproduce the problem

  1. Enable captcha & Customer login in shop settings
  2. shopify theme serve
  3. Browse to http://127.0.0.1:9292/account/login
  4. Submit a bad login
  5. You should be redirected to http://127.0.0.1:9292/challenge
  6. Solving the captcha and clicking “Submit” redirects you back to http://127.0.0.1:9292/challenge

Workaround

Disable captcha for Customer Login.

Specifications

  • App type: theme
  • Operating System: macOS
  • Shell: zsh
  • Ruby version (ruby -v): 2.7.1

About this issue

  • Original URL
  • State: open
  • Created 3 years ago
  • Reactions: 5
  • Comments: 34 (10 by maintainers)

Most upvoted comments

This issue seems inactive. If it’s still relevant, please add a comment saying so. Otherwise, take no action.

→ If there’s no activity within a week, then a bot will automatically close this.

Thanks for helping to improve Shopify’s dev tooling and experience.

@waxit-dev haha, only 5000?

you should be able to preview the theme using the ?preview_theme_id link as mentioned further up this thread

unfortunately no hot reload. if I am doing a lot of detail work on customer account layouts I’ll usually use placeholder content in a regular page template until I’m ready to test with live accounts

Disabling the reCAPTCHA worked great! I was able to login and complete testing on the localhost preview no problem. And only ended up with about 5000 bot accounts added to the store by the end of it… -_-

Is there any other work arounds aside from turning off captcha? Developing a theme on a live store for a client and don’t want to mess with their settings.

use the url with this format https://mysitename.myshopify.com/?preview_theme_id=129204027619

instead of the localhost url (http://127.0.0.1:9292)

Doesn’t this load the version of the site that is pushed up to Shopify and not what is on the local machine?

Still active

OKAY EVERYONE!! i have a potential solution to this or at least a place to start looking. Our store was experiencing this issue for months, tons of fake accounts being created because we had to shut recaptcha off. We could not find the issue, we exported our theme, did tons of queries for conflicting code, messed with recaptcha tokens, tried even utilizing recaptcha on our third party servers and redirecting the customer. None of it worked, we put our theme in our development instance of shopify, tested it, and…it worked. we had no idea why. Couldnt find a difference in the instances, they were identical.

We realized… the only difference is the apps installed on each instance.

So we contacted shopify plus support and after months of back and forth finally got them to dive into our theme to find the issue. They did, it was a custom account app called FLITS, it was causing the V2 recaptcha to not be able to redirect the customer to the account page.

This was there response "When reCAPTCHA v2 is engaged, the customer is referred to the ‘Challenge’ page. This page is not hosted in Shopify theme files or Admin - it is provided and managed by Google. Once the challenge has been successfully completed, the redirect looks for the customer account page. In this case, it looks like when that page is blank (because the content of the customers/account.liquid theme file has been commented out), the fallback is to route back to the customer account login page.

I have also confirmed that other third-party customer account apps have a similar issue with v2 redirect. The problem is that Google’s reCAPTCHA challenge page overrides the app’s redirect settings, looks for the .liquid it is expecting, and then loops back to the login page.

I do understand that reCAPTCHA is the most effective way to combat fake ‘bot’ accounts, and therefore your priority is to find a way to make it work with your desired customized customer account experience.

You can consider customizing the customers/account.liquid file, instead of using third-party apps to provide your customer account features. Or, you may be able to request a custom version of the customer account apps that can be recognized by the reCAPTCHA challenge page redirect. Google does offer development documentation: Google Dev Support : reCAPTCHA Developer’s Guide / Verifying the user’s response."

The issue was the challenge page could not redirect back to the account page. I realize many of you may not have custom account page apps, however what i recommend doing is checking to see what conflicts the challenge page could be running into with redirecting back to the account page. Its a good place to start.

Hopefully this helps someone.

Unfortunately, this doesn’t apply to this issue. This is an issue during theme development with Shopify itself and local vs server-side development. This happens without any type of apps installed.

This issue seems inactive. If it’s still relevant, please add a comment saying so. Otherwise, take no action.

→ If there’s no activity within a week, then a bot will automatically close this.

Thanks for helping to improve Shopify’s dev tooling and experience.

Still very much active. Someone should increase the bot threshold

Still happening, do we have any reported progress?

This issue seems inactive. If it’s still relevant, please add a comment saying so. Otherwise, take no action. → If there’s no activity within a week, then a bot will automatically close this. Thanks for helping to improve Shopify’s dev tooling and experience.

P.S. You can learn more about why we stale issues here.

This issue seems inactive. If it’s still relevant, please add a comment saying so. Otherwise, take no action. → If there’s no activity within a week, then a bot will automatically close this. Thanks for helping to improve Shopify’s dev tooling and experience.

P.S. You can learn more about why we stale issues here.

This issue seems inactive. If it’s still relevant, please add a comment saying so. Otherwise, take no action.

→ If there’s no activity within a week, then a bot will automatically close this.

Thanks for helping to improve Shopify’s dev tooling and experience.

use the url with this format https://mysitename.myshopify.com/?preview_theme_id=129204027619

instead of the localhost url (http://127.0.0.1:9292)