Security question hash saved in HTTP cache

[fritzmg]

Affected version(s)

4.9+

Description

Our FormCaptcha widget outputs a hidden input field with a hash that is valid for 30 minutes. However, if the HTTP cache is enabled this hash will of course also be cached and thus for a cached response containing a form with a security question widget the form will always not validate on the first attempt, since the hash does not validate (as it's too old after being in the cache for more than 30 minutes).

Reproduction

1. Create a form with a text field and the security question.
2. Insert the form on a page.
3. Enable the page cache in the settings of that page (or a parent page). Set the timeout to something larger than 30 minutes (e.g. 1 year).
4. Disable the debug mode.
5. Create a request in the front end to that page, so that the page is cached.
6. After 30 minutes refresh the page again and try to send the form. You will be asked to enter the security question.
7. Open the page in a new browser session / different browser and try to send the form. You will be asked to enter the security question.

/cc @ausi

[m-vo]

A page with a form containing a security hash should probably be private in the first place, right?

[ausi]

A page with a form containing a security hash should probably be private in the first place, right?

I don’t think so. The hash just has to match the time slot and the captcha-field answer. Caching it for short periods of time should be OK.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[fritzmg]

Should we implement an ESI fragment for this hash that can be cached independently after all then?

[aschempp]

I would prefer to modify the current page expiration to be no more than the 30min limit instead of ESI. Also, if client caching is enabled for more than 30min, ESI would not solve the problem.

[fritzmg]

It must be less than 30 minutes otherwise you might not have enough time to fill out the form.

[ausi]

As discussed in the call today, we want to make the captcha widget cacheable by getting an up-to-date hash from the server via JavaScript (with a small 5 seconds delay). The HTML itself would then not include the captcha hash and can therefore be cached.