Users who are attempting to register on our website are getting a "CAPTCHA session reuse attack detected" error when submitting our registration form.

We have confirmed in our test environments that the captcha form is cached (same sid, same token) when the form is rendered AND we have reCaptcha set as the captcha_point which seems to be causing this issue. However, we can't find exactly how or where this form is being cached. We can confirm that when we turn on the math captcha instead the caching issue does not happen.

We've done some cursory code exploration and see that the captcha module does some cache breaking stuff when generating the captcha that the reCaptcha module doesn't do, is that the problem? Anyone seen this before?

CommentFileSizeAuthor
#17 2893656-9.patch833 bytesTushar1
#8 2893656-8.patch531 bytesfinne
#3 recaptcha_caching-2893656-3.patch337 bytesben.denham
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

scrumorg created an issue. See original summary.

hass’s picture

hass CreditAttribution: hass commented
Status: Active » Closed (cannot reproduce)
ben.denham’s picture

ben.denham CreditAttribution: ben.denham at Catalyst IT commented
Status: Closed (cannot reproduce) » Needs review
FileSize
recaptcha_caching-2893656-3.patch337 bytes

I experienced the same issue, and applying the caching configuration that is used for captcha elements in the Captcha module seems to solve the problem.

Patch provided for further testing.

albertski’s picture

albertski CreditAttribution: albertski at Xeno Media, Inc. commented
Status: Needs review » Reviewed & tested by the community

Ran into the same issue. Verified that this fixed the issues and the patch looks good.

hass’s picture

hass CreditAttribution: hass commented
Status: Reviewed & tested by the community » Needs work
Issue tags: +Needs tests
pcorbett’s picture

pcorbett CreditAttribution: pcorbett at Redfin Solutions, LLC commented

It appears as though this has already been included in 8.x-2.2 -- not positive as line numbers have changed since the patch included above.

finne’s picture

finne
Primary language Dutch
Location Amsterdam
CreditAttribution: finne at Dx Experts commented

We are getting the same issue on our user login form. I' going to try the patch and see if it helps. Setting the cache max age to 0 is necessary for the captcha module I think.

finne’s picture

finne
Primary language Dutch
Location Amsterdam
CreditAttribution: finne at Dx Experts commented
FileSize
2893656-8.patch531 bytes

Here is a patch that applies the max-age and the cache killswitch, just as it is used in the captcha module image and math captchas. How would you go about testing this? Test that the resulting page is not cached, I guess?

finne’s picture

finne
Primary language Dutch
Location Amsterdam
CreditAttribution: finne at Dx Experts commented
Assigned: Unassigned » finne
finne’s picture

finne
Primary language Dutch
Location Amsterdam
CreditAttribution: finne at Dx Experts commented
Status: Needs work » Needs review
ruudvanoijen’s picture

ruudvanoijen CreditAttribution: ruudvanoijen commented

I've tested the last patch. The test I have used was on the user login page.
The kill switch seems to prevent it from caching.
According to the documentation. https://www.drupal.org/docs/8/api/cache-api/cache-max-age
That property can prevent the browser from caching. But Drupal can still cache page's without using the kill switch.

So all it needs now is unit tests.

hass’s picture

hass CreditAttribution: hass commented

But #2219993: Enable cacheable captcha support (once 2449209 is committed) implements a full cached version of recaptcha...

finne’s picture

finne
Primary language Dutch
Location Amsterdam
CreditAttribution: finne at Dx Experts commented

That sounds good (I'm all for caching more in drupal), but until that is comitted you might need this patch to make sure the current situation works without errors. This patch should definitely not be the focus of major efforts going forward. Enabling caching is a much better solution. So let's help to get 2449209 fixed first.

dandaman’s picture

dandaman CreditAttribution: dandaman commented

This patch seems to resolve the issue for me. If I have some time, I will try to add some tests to it, but don't hold your breath.

hass’s picture

hass CreditAttribution: hass commented
Status: Needs review » Closed (duplicate)

Please retest with latest captcha DEV as #2974083: Port to D8: support for cacheable captcha (recaptcha) has been committed and should solve this problem.

MiroslavBanov’s picture

MiroslavBanov CreditAttribution: MiroslavBanov as a volunteer and at FFW commented

@hass

I think you also need the patch from #2219993: Enable cacheable captcha support (once 2449209 is committed) to suppress the error message.

Tushar1’s picture

Tushar1 CreditAttribution: Tushar1 at TATA Consultancy Services for Pfizer, Inc. commented
FileSize
2893656-9.patch833 bytes

Patch #9 applied on latest version 3.x-dev

Rafael Maito’s picture

Rafael Maito CreditAttribution: Rafael Maito at Zoocha commented

The issue still happening, but applying the patch #17 resolved the issue.