0

I have to implement captcha so stop bots but the problem is that I work in an application where we do not create anything at client end ( no cookie etc) and we do not create any session.

One possibility is that the we create captcha image and a secret string(as hidden parameter) to user and at the time of submission of page the same information can be used to authenticate captcha using some key. Secret string will be created using key at server and the same key will be used to authenticate captcha. But any smart malicious user can keep these two inputs ( or any number of input parameters) with him and can use these parameters to authenticate anytime later.I can put some timestamp on the captcha but again in multiserver / cluster architecture it may cause problem because that timestamp file need to be synced in between and across the servers.

Can there be any other possibility?

Architecture where I need to impliment it- Multiserver / Multicluster no information of user s being stored in server no cookies or session can be made

1 Answer 1

0

I think you have offered the solution, more or less, yourself.

You can store the captcha on the server based on (1) a key, (2) an encoded timeout stamp, (3) the IP address of the caller, and (4) possibly some identifying information in the caller's browser identification (browser + version number). That should be pretty unique and hard (not impossible, but hard) to spoof.

Needless to say, you have to keep the timeout period very short, say 15 seconds or so.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.