Question is not programmatic but rather conceptual.
When a user is trying to fill in a contact form and then CAPTCHA code, if he/she accidentally refreshes the page or doesn't fill a required input field, he/she will come back to same page usually with a renewed CAPTCHA code. The user then needs to refill inputs and alas, encounters another CAPTCHA code which has to be solved again.
I - being a user before a developer - see it as a chore to constantly complete CAPTCHAs and wish that it could be changed in some way that doesn't make me unnecessarily distinguish those annoying characters another time.
Then being in my developer's shoes, I decide to change the way the CAPTCHA code is shown. I keep CAPTCHA code in a session and won't renew it programmatically unless:
- User wants to refresh it.
- User makes X mistakes in entering the same CAPTCHA code. (e.g. 3 times)
Otherwise, in each request the same characters are shown, there is no need to worry about unwanted refreshes. But being the developer who thought about it, there may be chances that someone could bypass it or do sabotaging things that I'm not aware of.
Can implementing this concept be safe and if not what could be its vulnerabilities?