As an anon user I am seeing the honeypot message that was generated for another user on a page that doesn't have a protected form.

I think that the following has happened:

1) crawler visits page

2) gets to the "register to comment" link

3) follows the link, fills in form and is denied.

4) is redirected back and message is displayed there and cached.

But I cannot reproduce 4. Anybody got other ideas? It is possible that the bot simply goes to the other page first and thus gets the message there...

Comments

geerlingguy’s picture

geerlingguy commented

I've had similar issues in the past when using certain types of caching, for anonymous users, along with something like Boost. But I'll look into this as well to see if I can figure out a way to prevent it.

geerlingguy’s picture

geerlingguy commented
Status: Active » Closed (cannot reproduce)

I tried getting this to happen, but couldn't. I wonder if it might have something to do with a reverse proxy caching the page, or some other caching layer... Feel free to reopen if you can produce a set of steps to reliably reproduce the problem :)