I wonder is it a good idea using captcha when using an anti-CSRF token on login page? I think it's impossible for robots to mess with login page because the token changes on every request.


In my idea captcha in login page is unnecessary and just bothering users you can use captcha after several attempts you can avoid attacker by using token and as I said captcha after several failing attempt. Use captcha in sign up page and use token in every form that you have in your web site.

| improve this answer | |
  • Your answer is inappropriate. I AM using captcha in sign-up page. In my idea captcha in login page is unnecessary WHY it's unnecessary?! – Sky Mar 16 '15 at 21:57
  • I said "bothering users" but it seems you have already know your answer before asking it and just want someone to say your idea. – Daniel.V Mar 16 '15 at 22:03

Yes its neccessary. A token can still be requested by a bruteforcer. Yes, it would cost the bruteforcer one request extra per try, but a captcha still blocks attempts completely instead.

If you dont want to bother your users with a captcha, you could set so when a incorrect password is used, the account in question will require a captcha. This both thwarth bruteforcers, but also alert the original account holder, that someone might try to access his account. To avoid that a bot might figure which accounts that exist or not, store this flag also for non-existing accounts.

| improve this answer | |

CSRF tokens aren't intended as a protection against bots at all. They're only intended as a protection against CSRF attacks. It's only coincidental that some bots don't handle CSRF tokens correctly, but many do. If you're worried about bots, then you should still use a CAPTCHA; the presence of CSRF tokens should not influence your decision on that.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.