request - Google recaptcha remoteip 解释

Question

在 documentation of recaptcha它说 remoteip参数是可选的，但我不明白它的用途，因为即使我发送的 IP 与 REMOTE_ADDR 不同，来自 Google 的响应仍然是有效的验证码。

Answer 1

是already asked in Information Security我会提供accepted answer这里也。因为不清楚主要是安全问题:

Because there could be a DNS/hosts reroute in place to allow the captcha to be parsed differently by a malicious user

One possible scenario is farming cheap labour to manually solve captchas and then submit them back with the form. Since the recaptcha only will serve the image once this is the lazy way to farm this out. ( redirect the requested image to elsewhere ).

If the IP address which requests the image is different to the IP address that requests the page then this would indicate this style of attack.