Add support for cacheable captcha's (recaptcha)

Here is a first draft of the patch. It will allow for reCAPTCHA with Ajax API to be used with caching enabled. So we can have caching of forms with captcha. And don't forget that reCAPTCHA is accessible. Unfortunately with this patch only reCAPTCHA will work. Captcha modules that use the normal captcha session handling will not work (captcha validation will fail), because the session handling is completely gutted.

I am thinking that there should the option to have custom session handling built into the captcha module, with the option to manage it externally - in a lightweight PHP script, or maybe a nodejs. But I am not yet sure how to implement it in a very elegant way, while keeping compatibility.

I seem to have broken the patch with a last-minute change. I will add a working patch soon.

@nicrodgers
My goal is to keep the so-called "Captcha session" managed separately from Drupal, so it wouldn't need a Drupal bootstrap in order to generate or use it, and Session API module doesn't look like it will help in this scenario.

Here is a fixed patch. I have removed the disabling of cache under all conditions, and have made changes so only reCAPTCHA will validate correctly, and other CAPTCHAs currently will just be always correct. This is how I will be using it for a project in which performance is a high concern.

Here is the CAPTCHA part of my build:

projects[captcha][type] = "module"
projects[captcha][subdir] = "contrib"
projects[captcha][download][type] = "git"
projects[captcha][download][url] = "http://git.drupal.org/project/captcha.git"
projects[captcha][download][branch] = "7.x-1.x"
projects[captcha][download][revision] = "d873056becb1a85905ab512f1fce18397ecb16e1"
projects[captcha][patch][] = "http://www.drupal.org/files/issues/reCAPTCHA_ajax_API_compatibility-captcha-2449209-4.patch"

projects[recaptcha][subdir] = "contrib"
projects[recaptcha][version] = "1.12-rc1"

@wundo

I intentionally created this issue in CAPTCHA module. It's not a mistake. Some adjustments to the CAPTCHA API are needed to support reCAPTCHA+caching. There already is an issue in reCAPTCHA about this.

@koppie
I guess you are not getting the annoying 'CAPTCHA session reuse attack detected' error. That's good.

The problem is that the pages with captcha are still not cacheable. It doesn't matter if you use recaptcha ajax API, and if you use latest dev version of captcha. If you think otherwise, can you direct me to a web page which is cached and uses recaptcha? It is easy to determine if it is cached by looking at the response headers.

Let's have correct status. Issue is not fixed because pages are not cacheable.

@koppie
I'm referring to full page cache, which you can cache in Varnish, and directly serve for different HTTP requests. Looking at the headers, I am think you always hit the backend. I've attached a screenshot to show.

I was just wondering (doubting) if it really is solved.

I created the patch in the past because of reasons that are now irrelevant. But I am still interested in the topic, and how far the modules have progressed, what has changed.

Probably with Drupal 8 the whole problem should be approached from different angle.

#19

+1

Doing a basic test, this appears to work well with recaptcha 7.x-2.2 + the recaptcha patch. Tested with Contact module.

I think the reroll overlooked something and a message is shown in cases where it shouldn't be shown, and it is shown twice in cases where it should be shown once.

Fixes issue from my previous comment.

Moved the patch from #33 to a follow-up #2956916: Follow-up to #2449209, fix double message. Closing this issue as it is done.

@hass

I don't mind if it's committed in this issue instead of the follow-up issue, but it's now been two months since the patch and it's unfortunately not committed yet. I was contacted by a member of the community to ask for help because he was confused. I created the follow-up issue because I thought it was more clear, and less confusing this way.