Captcha session reuse attack detected error message in form with anonymous user

Question

I am experiencing a problem with the Captcha module 7.x-1.3 version (under Drupal 7.39)

• I don't use webforms
• My form is a simple Contact form
• My form does not contain any AJAX field
• My form does not contain any file or image upload system
• I configured the captcha Module, giving the good name for the form
  • form_id : xxxxxx_contact_form
  • Challenge type : Image (from module image_captcha)
• In the Configuration (admin/config/development/performance)
  • The page cache for anonymous users is unchecked = NOT ACTIVATED
  • The cache for blocks is unchecked = NOT ACTIVATED

The code of the Captcha for my form is :

$form['xxxxxx_contact_captcha'] = array(
  '#title' => t('Vérification'),
  '#type' => 'captcha',
  '#captcha_type' => 'image_captcha/Image',
);

When a user is connected the form submission works well without any problem BUT when NO user is connected (= anonymous session), i get the following errors :

• CAPTCHA session reuse attack detected.
• The answer you entered for the CAPTCHA was not correct.

(in french) :

• Attaque à base de réutilisation de session de CAPTCHA détectée.
• La réponse saisie pour le CAPTCHA est incorrecte.

EXAMPLE :

For example, with a "TT7Zi" Captcha image, when I submit the form (in anonymous) : I get the following errors on the screen :

• CAPTCHA session reuse attack detected.
• The answer you entered for the CAPTCHA was not correct.

And in the logs (watchdog) I get two times the same entry :

Message xxxxxx_contact_form post blocked by CAPTCHA module: challenge Image (by module image_captcha), user answered "TT7Zi", but the solution was "542dda8e8d7fda2358b4b2f319ef198b".

Any solution for this issue will be really helpful. Thank you all.

Answer 1

The problem comes from the fact that it is NOT necessary to add the form_id and Captcha method in the Captcha Configuration when you use a custom form.

If you do this, when the form is generated on the page, the Captcha module is called TWO TIMES instead of only one, and this causes some troubles in the database, because when you call the form page, and when you submit it, TWO lines are created in the captcha_sessions table instead of only ONE !!

So, you will have :

Line number | Token    | Code
------------------------------------------------
N           | AAAAA... | TT7Zi                   <=== FIRST CALL
N+1         | BBBBB... | dccedb00fa1234567890... <=== SECOND CALL (ABNORMAL)

Then, when you submit, a new line is created in the captcha_sessions :

Line number | Token    | Code
------------------------------------------------
N           | XxXxX    | Zjj7R    ( UPDATE of the whole former TT7Zi line )
N+1         | BBBBB... | dccedb00fa1234567890...
N+2         | CCCCC... | 542dda8e8d7fda2358b4b2f319ef198b <== SECOND CALL !!

That's why the generated WATCHDOG error line says :

user answered "TT7Zi", but the solution was "542dda8e8d7fda2358b4b2f319ef198b".