maniwani icon indicating copy to clipboard operation
maniwani copied to clipboard

Lazily generate captchouli CAPTCHAs

Open DangerOnTheRanger opened this issue 6 years ago • 0 comments

At present, captchouli CAPTCHAs are generated and embedded with every JS-enabled, uncached thread render (non-JS clients have a separate link and non-cached form for replies, so this issue and the problems therein don't apply). This has several problems:

  1. Most clients will be viewing and not posting, so generating a new CAPTCHA is a needless waste of CPU cycles. This isn't as much of an issue with the new caching system as it was before (where every single request would generate a new CAPTCHA), but it leads into problem
  2. It is conceivable that two separate users would load the same cached thread render (and thus load the same captchouli CAPTCHA) and both would attempt to post - but since each CAPTCHA can only be solved once, only the first post submitted would be accepted. I'm not sure how often this would happen - since making a post invalidates the thread cache, both users would have to load the same thread before the other posted, but it could easily happen on a high-traffic site.
  3. While the images are small, they still increase the size of the document, which is especially bad considering point 1 (they are waste space for most thread views).

The solution is to request a new CAPTCHA whenever the reply form is opened up, insert the CAPTCHA into the form, and pass it to the server upon submission. This would require a new API endpoint to request a CAPTCHA, but that shouldn't be too difficult.

As a final sidenote, this is already the way reCAPTCHA works, so no further modification is needed for reCAPTCHA.

DangerOnTheRanger avatar May 17 '19 06:05 DangerOnTheRanger