This is an automated email from the ASF dual-hosted git repository.
papegaaij pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/wicket.git
The following commit(s) were added to refs/heads/master by this push:
new 92075fef19 Document that KittenCaptchaPanel is not a production bot
defence
92075fef19 is described below
commit 92075fef19e80fba13fafd9f5be4fde30dd1e659
Author: Emond Papegaaij <[email protected]>
AuthorDate: Tue Sep 1 15:32:17 2026 +0200
Document that KittenCaptchaPanel is not a production bot defence
The panel offered no indication of how weak it is. The animals are
composited without rotation, scaling or noise so an automated client can
match them directly, the number of possible answers is small enough to be
worth guessing outright, and the challenge comes from a single generator
seeded with a fixed constant and shared across the JVM, so a freshly
started application produces the same sequence of challenges everywhere.
Say so on the class, and point at what to use instead when real protection
against automated submissions is needed.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
---
.../extensions/captcha/kittens/KittenCaptchaPanel.java | 17 ++++++++++++++++-
1 file changed, 16 insertions(+), 1 deletion(-)
diff --git
a/wicket-extensions/src/main/java/org/apache/wicket/extensions/captcha/kittens/KittenCaptchaPanel.java
b/wicket-extensions/src/main/java/org/apache/wicket/extensions/captcha/kittens/KittenCaptchaPanel.java
index b861b04134..f932f58d9f 100644
---
a/wicket-extensions/src/main/java/org/apache/wicket/extensions/captcha/kittens/KittenCaptchaPanel.java
+++
b/wicket-extensions/src/main/java/org/apache/wicket/extensions/captcha/kittens/KittenCaptchaPanel.java
@@ -58,7 +58,22 @@ import org.slf4j.LoggerFactory;
/**
* A unique and fun-to-use captcha technique I developed at Thoof.
- *
+ * <p>
+ * <b>This is a very limited captcha and is not meant to protect a production
application against
+ * bots.</b> Treat it as a novelty or a light nuisance filter, not as a
security control. The
+ * animals are drawn from a small fixed set and are composited without
rotation, scaling or noise,
+ * so an automated client can match them directly; the number of possible
answers is small enough
+ * to be worth guessing; and the challenge is produced by a single generator
seeded with a fixed
+ * constant and shared across the JVM, so the sequence of challenges a freshly
started application
+ * produces is the same everywhere.
+ * </p>
+ * <p>
+ * If you need real protection against automated submissions, use a
purpose-built captcha service,
+ * or a defence that does not rely on the client being human at all — rate
limiting, or
+ * authentication. {@code CaptchaImageResource} in the sibling package
randomises its challenge
+ * more carefully, but it is still a simple home-grown image captcha and the
same caution applies.
+ * </p>
+ *
* @author Jonathan Locke
*/
public class KittenCaptchaPanel extends Panel
