Has anyone integrated FriendlyCaptcha in Adaptive forms?

​@Vishal_Anand No out-of-the-box (OOTB) FriendlyCaptcha integration exists in Adaptive Forms. AEM Forms supports Google reCAPTCHA and (in newer/EA paths) also hCaptcha / Cloudflare Turnstile, but FriendlyCaptcha would be a custom captcha provider integration. See: https://experienceleague.adobe.com/en/docs/experience-manager-cloud-service/content/release-notes/release-notes/2024/release-notes-2024-6-0

Best-practice integration pattern:

1. Client side (form UI)
   • Render FriendlyCaptcha widget (their JS) in the form (usually via a custom component or injecting JS).
   • When the challenge completes, capture the token/solution and store it in:
     • a hidden field, or
     • the submission metadata (implementation-dependent).
2. Server-side validation (mandatory)
   • On submit, validate the token server-side before processing/storing anything.
   • In AEM Forms, the clean way is a custom submit action / server hook that calls the provider verify API and fails the submit if invalid. AEM explicitly supports captcha validation via ValidateCAPTCHA API from a custom submit action / servlet patterns: https://experienceleague.adobe.com/en/docs/experience-manager-65/content/forms/adaptive-forms-basic-authoring/captcha-adaptive-forms (see the section about custom Submit Action + ValidateCAPTCHA).
3. Security/gov best practices
   • Keep FriendlyCaptcha secret key server-side only (OSGi config/secret manager), never in clientlibs.
   • Treat missing token as failure (don’t “skip captcha if token missing”).
   • Log only minimal debug info (no tokens), and consider rate limiting.

AEM Forms version matter:

• AEM Forms 6.5 Foundation-based Adaptive Forms (AFv1):
  • You can implement a custom captcha validator using the AEM Forms captcha validator interface, then invoke validation from a custom submit action/servlet. Interface reference:https://developer.adobe.com/experience-manager/reference-materials/6-5/javadoc/com/adobe/aemds/guide/service/GuideCaptchaValidator.html
• AEM Forms as a Cloud Service / Core Components (AFv2)
  • Prefer supported captchas (reCAPTCHA / hCaptcha / Turnstile). If you must use FriendlyCaptcha, do it via a custom submit action/server endpoint that verifies token, since “pluggable provider” behavior isn’t generally OOTB.

Thanks,
Amit