The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.Problem
- Automated security audit tools identify the JSON response for switching between image and audio CAPTCHAs as a possible JSON Hijacking attack vector. (which is invalid in Mollom's case)
- Regardless of that false-alarm, the response to the GET request might be mistakenly cached by poorly configured caches and proxies.
| Comment | File | Size | Author |
|---|---|---|---|
| #6 | 0001-1797054-by-sun-Use-POST-instead-of-GET-to-switch-bet.patch | 3.04 KB | sun |
| #4 | mollom.captcha-request-method.4.patch | 2.56 KB | sun |
| #2 | mollom.captcha-request-method.2.patch | 2.15 KB | sun |
| mollom.captcha-request-method.0.patch | 1.54 KB | sun |
Comments
Comment #2
sunAdjusted MollomCaptchaTestCase.
Comment #4
sunThe built-in drupalPost() method cannot be used here, since it attempts to perform a GET request to the specified URL first, in order to parse and submit a potential form on the target page. Hence, we need to copypaste some internals from the testing framework to facilitate the pure POST request.
Comment #6
sunComment #7
sunManually tested for both D7 and D6, and committed to both branches.