Doing some action (creating account, editing article etc) which requires CAPTCHA may fail in the post action process (invalid username selected, AbuseFilter prevent editing etc) - in such case CAPTCHA shouldn't be required again. Requiring CAPTCHAs again and again is very unfriendly.
Possible solutions:
That sounds reasonable! I think it would be possible to save such an information in redis/memcached/objectcache, e.g. the time when the CAPTCHA was solved (so a user needs to solve a new CAPTCHA after, e.g., 10 minutes) and a unique identification of one session.
Change 265791 had a related patch set uploaded (by Florianschmidtwelzow):
Add the possibility to solve a CAPTCHA only once in a configurable timespan
once a user filled CAPTCHA correctly for some action token, don't require it again
What is "some action token"?
store CAPTCHA cookie locally for short time and allow the user to skip captchas
This approach, and the patch, means that once a human has solved the CAPTCHA, the session can be used and abused by a bot.
It is critical that if a CAPTCHA is going to last more than one action, that the CAPTCHA only lasts for a predetermined number of edits, as well as any time limit. A lot of edits can be done in a very short period of time.
IMO the CAPTCHA should last only until the user has successfully completed one write operation for the action type that triggered the CAPTCHA, with a time limit of course.
A simpler implementation is that a CAPTCHA lasts until the next successful write action of any type.
i.e. if they continue to be unsuccessful, for other reasons, they dont need to solve CAPTCHA again. But as soon as they have completed one write operation, a CAPTCHA is required again.
Change 265791 abandoned by Florianschmidtwelzow:
Add the possibility to solve a CAPTCHA only once in a configurable timespan
Reason:
This is a fairly bad idea :/
This should probably be done by converting successfully solved captchas into success tokens stored in the session, and consuming a success token whenever a captcha is needed (e.g. end of account creation) and not showing the captcha interface if there are any success tokens of the given type available.