RediNews CAPTCHA Facility

The RediNews CAPTCHA tool can be used by client websites to validate human interaction during form submission. It can be used independently of any other RediNews component.

The CAPTCHA facility consists of a per-request generated graphic containing a graphically rendered passphrase. This graphic is presented to the user who responds by typing the text of the passphrase. This effectively prevents scripted access to subsequent pages. CAPTCHA testing is helpful as a gateway to any system that offers member registration, user comments, downloads, etc.

Using the CAPTCHA tool is straightforward. You include the RediNews CAPTCHA graphic and include a unique string in the URL as a client-key. This client-key should be generated on a per-request value, and must contain between 8 and 128 printable characters.

This request will generate a 300 pixel x 50 pixel graphic as follows:

This graphic is valid for 180 seconds or one test evaluation.

The client should include this graphic on an input form, submittable to the client server, and retrieve both the user interpretation (passphrase) of the phrase presented, as well as the client-key specified for the graphic.

The client can then make a server-side test of the users response by accessing the following URL:

http://your-alias.redinews.com/tools/CT01?clientkey=clientkey&passphrase=user-provided-passphrase

Accessing this URL as indicated (by AJAX or server side script) will cause the CAPTCHA server to evaluate the passphrase provided by the user and make an HTTP response as follows:

200 (OK) The user has responded with the correct passphrase.
400 (Bad Request) No test possible: bad clientkey, the test is invalid due to prior request or, the test has not been made within the allotted time.
401 (Unauthorized) The user has answered incorrectly.

The CAPTCHA tool thus has two roles: one as graphic source, and one as response evaluator. The role is determined by the URL arguments passed to the tool.

The test may be evaluated one time only, and must be made within 180 seconds of the initial request for the graphic. These restrictions enhance security by ensuring that repeated test attempts cannot be made.

An example of the CAPTCHA test with a cgi backend is located here, comments are welcome.