Minimum time condition for one user locks out all other users [#2573703]

When I submit the form under the minimum time specified in settings, I see the expected message asking me to wait X number of seconds. The problem is that all the other users of this form also start seeing the same message, even though they did not submit the form under the minimum time. Very soon the number of seconds to wait reaches its maximum value. It effectively locks out everybody out of this particular form.

Comments

Comment #1

24 September 2015 at 00:05

derekg created an issue. See original summary.

Comment #2

geerlingguy CreditAttribution: geerlingguy as a volunteer and at Acquia commented 24 September 2015 at 01:44

Category:	Bug report	» Support request
Priority:	Major	» Normal

@derekg - Do you have this site running behind a load balancer? Also, what kind of form is the form that's having this trouble? And can you do a curl --head request for the page that has the form and post the results (redacting anything you don't want to appear here).

If you'd like, you can also PM me the page in question (if it's publicly accessible) and I'll see if there's something obvious going wrong.

Comment #3

derekg CreditAttribution: derekg commented 24 September 2015 at 17:36

Yes, the web site is running behind the load balancer. This form is for visitors to manage their newsletter preferences.

Below is the output from curl --head:

HTTP/1.1 200 OK
Date: Thu, 24 Sep 2015 17:16:08 GMT
Server: Apache
X-Drupal-Cache: HIT
Etag: "1443114268-0"
Content-Language: en
X-Generator: Drupal 7 (http://drupal.org)
Link: ; rel="image_src"
X-UA-Compatible: IE=Edge,chrome=1
Cache-Control: public, max-age=0
Last-Modified: Thu, 24 Sep 2015 17:04:28 GMT
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Vary: Cookie,Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Set-Cookie: NB_SRVID=srv96139; path=/
Cache-control: private

Comment #4

geerlingguy CreditAttribution: geerlingguy as a volunteer and at Acquia commented 26 September 2015 at 02:59

The X-Drupal-Cache: HIT means that Drupal's serving up a cached copy of the page. Honeypot should automatically disable page cache on the page if timestamp protection is in place, and if any form on the page uses Honeypot form protection.

I wonder if there's something that's overriding Honeypot's disabling of the cache?

Comment #5

geerlingguy CreditAttribution: geerlingguy as a volunteer and at Acquia commented 11 March 2016 at 04:35

Version:	7.x-1.21	» 7.x-1.x-dev
Status:	Active	» Postponed (maintainer needs more info)

Marking this postponed; if this is still an issue, please let me know more detail, and maybe a way to reliably reproduce the condition. It sounds to me like it's some sort of caching issue, and those can be incredibly 'fun' to figure out.