We are seeing sporadic cases, where captcha prints this error message to the screen:

CATPCHA session reuse attack detected

( from catcha.module #363 if statement).

Looking at the issue queue, various other people have reported problems with this, but none of the usecases seem to fit.

Furthermore, it seems to be sporadic and I have not found a way to reproduce this error reliably ( or at all). Whenever this occurs, the captcha still proceeds, and we are getting all the information from the form; however this is very confusing to the end-user who thinks something went wrong ( we had several people contact us about this).

In one of the other treads, somebody suggested to simply turn this error message into a watchdog message ( or in D8, a logger), and not write to the screen any longer. I would like to request this officially.
( I marked it as 'bug,' as there is an underlying problem somewhere).

So in our case, we have changed
drupal_set_message(t('CAPTCHA session reuse attack detected.'), 'error');
into
\Drupal::logger('captcha')->error(t('CAPTCHA session reuse attack detected.'));

I understand this is at best a workaround, but since the underlying problem seems to be hard to diagnose and does not cause a problem to the enduser, I think this solution is OK. We would still see the error in the DB log, and could then debug this further, but at least it is more user friendly.

CommentFileSizeAuthor
#18 CAPTCHA-session-resue-log-instead-message-2896957-18.patch3.53 KBpelicani
#2 CATPCHA-session-reuse-attack-2896957-2.patch626 bytesarunkumark
#11 CAPTCHA-session-resue-log-instead-message-2896957-11.patch3.45 KBblacklabel_tom
#13 CAPTCHA-session-resue-log-instead-message-2896957-13.patch3.55 KBklidifia
#14 CAPTCHA-session-resue-log-instead-message-2896957-14.patch3.56 KBklidifia

Comments

hoporr created an issue. See original summary.

arunkumark’s picture

arunkumark
Location Coimbatore
commented
Status: Active » Needs review
StatusFileSize
new CATPCHA-session-reuse-attack-2896957-2.patch626 bytes

@horror thanks for more information on this issue. Instead of error making as a log will help to end user to avoid confusions. As per your suggestion, i have created a patch.

Status: Needs review » Needs work

The last submitted patch, 2: CATPCHA-session-reuse-attack-2896957-2.patch, failed testing. View results

andyg5000’s picture

andyg5000
Primary language English
Location North Carolina, USA
commented

The tests failed because they depend on the message being rendered on the page. I started to rewrite the tests against your patch, but I think the error should be shown when it is a legitimate error. The wording "attack" is very bad to show to visitors on accident as it makes them question the security of your website, especially for e-commerce sites.

There are two things I think need to happen:

1) Fix the issue with the cached/stale captcha token

The work in #1395184: Forms with AJAX trigger "CAPTCHA session reuse attack detected." error has been committed. Can you see if the current -dev release resolves your issue?

I confirmed that the captcha_token value was persisting on my install, but have not tried the update from the issue above yet.

2) Rewrite the error message so it doesn't make the user think they've been hacked when there is a false positive.

Maybe something like:

drupal_set_message(t('Your form submission could not be validated due an issue with the CAPTCHA.'), 'warn');

borisson_’s picture

borisson_
Primary language Dutch
Location Mechelen, 🇧🇪
commented
Version: 8.x-1.0-beta1 » 8.x-1.x-dev
Issue tags: -captcha

@andyg5000: the patch here was created after #1395184: Forms with AJAX trigger "CAPTCHA session reuse attack detected." error was committed a year ago.

We're running the latest tagged release, which is at this time only one commit behind on the -dev release (#2855165: Deprecated methods and function). On that version we're still getting this issue. We had a customer mention this last week.

The problem seems to be that I can't reproduce this issue, so I can't give any more helpful information either.
For now, we've applied the patch in #2, but I agree with the initial assesment that this is not a solid longtime solution.

I'm not sure if rewriting the message is sufficient, we should try to find why this is happening and fix the root cause.

borisson_’s picture

borisson_
Primary language Dutch
Location Mechelen, 🇧🇪
commented
Title: Change "CATPCHA session reuse attack detected" screen-error into watchdog/logger » Change "CATCHA session reuse attack detected" message into watchdog/logger
borisson_’s picture

borisson_
Primary language Dutch
Location Mechelen, 🇧🇪
commented
Title: Change "CATCHA session reuse attack detected" message into watchdog/logger » Change "CAPTCHA session reuse attack detected" message into watchdog/logger
benjifisher’s picture

benjifisher
he/him or they/them
Primary language English
Location Boston area
commented

I think #2968549: Log CAPTCHA session reuse attacks is a duplicate of this issue, except that one adds logging and keeps the on-screen error message. Also, the other issue logs the expected and actual CAPTCHA response.

elachlan’s picture

elachlan commented
Status: Needs work » Closed (duplicate)
blacklabel_tom’s picture

blacklabel_tom commented
Status: Closed (duplicate) » Active

Hi,

Re-opening this one as I think this is a better solution than https://www.drupal.org/project/captcha/issues/2968549.

If this warning doesn't stop users from submitting the form then we should just log the warning instead of displaying it. The patch in the above issue does both which I don't think makes sense.

Looking at the code in _captcha_get_posted_captcha_info() the check is to make sure that the CAPTCHA is valid per form, but doesn't stop submissions.

I think it would be best to log that this token mis match has happened and move on.

Cheers

Tom

blacklabel_tom’s picture

blacklabel_tom commented
StatusFileSize
new CAPTCHA-session-resue-log-instead-message-2896957-11.patch3.45 KB

Hi,

I've attached a patch to show what I mean. I've refactored the code a little to make the testing a bit easier as I can't for the life of me figure out how you're meant to test if watchdog entries have been populated.

I've done the tests refactoring blind because I cant run tests locally for some reason.

Cheers

Tom

klidifia’s picture

klidifia commented
Status: Active » Needs review

Despite the latest dev branch and https://cgit.drupalcode.org/captcha/commit/?id=1c2632a7f6d0b4e2c87066b1a...
This message incorrectly persists. Makes sense to db log and not to drupal_set_message it!

klidifia’s picture

klidifia commented
StatusFileSize
new CAPTCHA-session-resue-log-instead-message-2896957-13.patch3.55 KB

Reroll against dev. Removed the now unused testing constant and put both IF conditions in the same statement (introduced in #2974083: Port to D8: support for cacheable captcha (recaptcha)

klidifia’s picture

klidifia commented
StatusFileSize
new CAPTCHA-session-resue-log-instead-message-2896957-14.patch3.56 KB

  • elachlan committed eec2e2d on 8.x-1.x authored by klidifia 
    Issue #2896957 by klidifia, blacklabel_tom, arunkumark: Change "CAPTCHA...
elachlan’s picture

elachlan commented
Status: Needs review » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

pelicani’s picture

pelicani commented
StatusFileSize
new CAPTCHA-session-resue-log-instead-message-2896957-18.patch3.53 KB

This may or may not help someone else.
But since Dev hasn't been updated in a while, someone may need this fix for the beta1 version of captcha.

Here is a patch that applies #14 to beta1.
I'm including this in my composer.json file for update.

peace,
Michael