maniwani
maniwani copied to clipboard
Lazily generate captchouli CAPTCHAs
At present, captchouli CAPTCHAs are generated and embedded with every JS-enabled, uncached thread render (non-JS clients have a separate link and non-cached form for replies, so this issue and the problems therein don't apply). This has several problems:
- Most clients will be viewing and not posting, so generating a new CAPTCHA is a needless waste of CPU cycles. This isn't as much of an issue with the new caching system as it was before (where every single request would generate a new CAPTCHA), but it leads into problem
- It is conceivable that two separate users would load the same cached thread render (and thus load the same captchouli CAPTCHA) and both would attempt to post - but since each CAPTCHA can only be solved once, only the first post submitted would be accepted. I'm not sure how often this would happen - since making a post invalidates the thread cache, both users would have to load the same thread before the other posted, but it could easily happen on a high-traffic site.
- While the images are small, they still increase the size of the document, which is especially bad considering point 1 (they are waste space for most thread views).
The solution is to request a new CAPTCHA whenever the reply form is opened up, insert the CAPTCHA into the form, and pass it to the server upon submission. This would require a new API endpoint to request a CAPTCHA, but that shouldn't be too difficult.
As a final sidenote, this is already the way reCAPTCHA works, so no further modification is needed for reCAPTCHA.