Lyla Captcha

Frequently Asked Questions
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.

What is a Captcha?
A Captcha is a type of challenge-response test used to determine whether or not the user is human. A common type of captcha requires that the user type the letters of a distorted, sometimes with the addition of obscured sequence of letters or digits that appears in an image. A Captcha can also be administered in the form of question in which the user provides the correct answer.
What does Captcha stand for?
Captcha is an acronym for "completely automated public Turing test to tell computers and humans apart" and was coined in 2000 by a few computer scientist at Carnegie Mellon University and IBM. However, Alan Turning described challenge-response tests in a 1950's paper. While the modern day Captcha was developed at AltaVista in 1997 to prevent bots from adding URLs to the search engine. Everything else is history.
What applications do Captcha have?
Captchas are used to prevent bots from consuming your website's services. Some applications include, but are not limited to preventing bots from:
  • registering for free email accounts
  • using bulletin boards, listserves, instant messaging services, etc.
  • responding to online polls
  • filling out online contact forms
Are Captchas accessible?
The simple answer is it depends on implementation. Visual based Captchas are based on the ability to read text which excludes visually impaired users from using protected services because common assistive technologies such as screen readers cannot interpret them.

Some implementation allow users to access audio based Captchas. However, even today these implementations are not as prevalent on the internet and Lyla Captcha only implements visual based Captchas. Despite some accessibility issues, Captchas are being used by many large internet services like PayPal, Gmail, Hotmail, Yahoo and are commonly seen on weblogs.
Why did you name it Lyla?
I could tell you about the reason behind my madness, but I'd rather not. Let's just say it's an homage to a very understanding person in my life. The air of mystery is more fun anyways. Maybe you can figure it out. Clues exist in this documentation.
How is LylaCaptcha Licensed?
LylaCaptcha is licensed under an Apache 2.0 style license and owned by the Maestro Publishing, LLC. You can use LylaCaptcha in any commercial application as long as you abide by the license and additional restrictions. The additional restrictions are:
  • The "LylaCaptcha" attribution text must be displayed in the generated Captcha image. Please do not comment out or otherwise change the the source code to defeat this request.
  • You may distribute LylaCaptcha within/embedded your application.
  • Please to not sell the LylaCaptcha package by itself as this against the spirit of this open source project.
Who created and maintains LylaCaptcha?
LylaCaptcha was created by Peter J. Farrell and was based on the work of Mark Mandel's original open source Captcha. If you have any questions, comments, bug reports or want to contribute bug fixes or new features, feel free to send a message to Peter J. Farrell at pjf@maestropublishing.com. Please do not feel bad if you don't get an immediate response as I am pretty busy these days.
How do I install Lyla Captcha?
Lyla does not require any ColdFusion mappings or other special installation requirements. You should be able to unzip the package and use it. I am not entirely sure if there will be any problems using Lyla on headless systems. Let me know if you get strange Java errors on headless sytems.
How do I configure Lyla Captcha?
The easiest (and most recommended way) to configure LylaCaptcha is to use the XML configuration file. The configuration file consists of 34 config type directives as well as the ability to define the fonts to use in your Captchas. Lyla ships with a decent rendering settings. If you intend to create Captchas to a file, you should just have to set the outputDirectory setting and be able to use Lyla.

Config Name Default Type Accepted Values Description
outputDirectory img/ string valid path or mapping Directory path to store generated Captchas
outputDirectoryIsRelative true boolean
  • True
  • False
Switch is the output directory is relative [Uses ExpandPath()]
saltType auto string
  • auto
  • defined
The salt type to use. Use �auto� if the Captcha is being deployed to non-sticky session servers.
saltValue [null] string must be at least 10 characters long for security The salt value. Use if the saltType is �Auto�.
jpegQuality 0.90 numeric decimal between 0-1.00 The quality setting for JPEG.
jpegUseBaseline true Boolean
  • True
  • False
Switch for JPEG baseline.
useAntiAlias true Boolean
  • True
  • False
Switch for JPEG anti-aliasing
randStrType alpha string
  • alpha
  • alphaLCase
  • alphaUCase
  • alphaNum
  • alphaNumLCase
  • secure (alphaNum + special)
Type of random string to generate for the Captcha unless the text is passed into the service
randStrLen 6 numeric whole number only *Average number of characters o use in the Captcha (varies -1 to +1 of the value)
width 250 numeric whole number only Desired width
height 75 numeric whole number only Desired height
fontsize 30 numeric whole number only *Average font size to use in the Captcha
leftOffset 20 numeric whole number only *Average number of pixels to offset the first character
shearXRange 25 numeric whole number only *Average X axis shear range
shearYRange 25 numeric whole number only *Average Y axis shear range
fontColor light string
  • light
  • medium
  • dark
  • lightGray
  • mediumGray
  • darkGray
The color range to use for the Captcha characters
backgroundColor dark string
  • light
  • medium
  • dark
  • lightGray
  • mediumGray
  • darkGray
The color range to use for the background
useGradientBackground true Boolean
  • True
  • False
Switch for gradient type background
backgroundColorUseCyclic true Boolean
  • True
  • False
Switch for wavy/oscillating background.
useOvals true Boolean
  • True
  • False
Switch for ovals in the background
ovalColor medium string
  • light
  • medium
  • dark
  • lightGray
  • mediumGray
  • darkGray
The color range to use for ovals
ovalUseTransparency true Boolean
  • True
  • False
Switch for transparency (alpha channel) when creating ovals
minOvals 15 numeric whole number only Minimum number of ovals
maxOvals 20 numeric whole number only Maximum number of ovals
useBackgroundLines true Boolean
  • True
  • False
Switch for background lines
backgroundLineColor medium string
  • light
  • medium
  • dark
  • lightGray
  • mediumGray
  • darkGray
The color range to use for background lines.
backgroundLineUseTransparency true Boolean
  • True
  • False
Switch for transparency (alpha channel) when creating background lines
backgroundMinLines 5 numeric whole number only Minimum number of background lines
backgroundMaxLines 10 numeric whole number only Maximum number of background lines
useForegroundLines true Boolean
  • True
  • False
Switch for foreground lines
foregroundlineColor light string
  • light
  • medium
  • dark
  • lightGray
  • mediumGray
  • darkGray
The Color range to use for foreground lines.
foregroundLineUseTransparency true Boolean
  • True
  • False
Switch for transparency (alpha channel) when creating foreground lines
foregroundMinLines 5 numeric whole number only Minimum number of foreground lines
foregroundMaxLines 10 numeric whole number only Maximum number of foreground lines

How do I know which fonts to use?
Lyla provides a utility method called getAvailableFontNames()to help you decide what fonts are available on the host system. All you need to do is select the fonts you want to use in the XML configuration file. Example:

<fonts>
  <font use="true" name="Arial"/>
</fonts>
How do I init and setup the Captcha service?
You must call init() when using Lyla. You can setup the Captcha service via the XML configuration file (recommended) or you can use populate the captchaConfigBean youself.

XML configuration file method (recommended):
  <cfset captcha = CreateObject("component","pathTo.captchaService").init
  (configFile="/pathTo/captcha.xml") />

Prepopulated captchaConfigBean:
  <cfset captcha = CreateObject("component","path.to.captchaService").init
  (configBean=myCaptchaConfigBean) />

After you have init()ed the service, you must call setup() on the object:
  <cfset captcha.setup() />

Although this may seem silly, this was built-in for users that use dependency injection for their config file or config bean via property injection in ColdSpring . Voila! The service is ready to use. It�s is best practice for you to store the Captcha service in a persistent scope (i.e. application) or use ColdSpring to manage your objects so it service is not re-init�ed on every request.
How do I setup the Captcha service with ColdSpring?
Here is a code snip for you to use in your ColdSpring configuration file:

<bean id="captchaService" class="path.to.captchaService" init-method="setup">
  <constructor-arg name="configFile">
    <value>/path/to/captcha.xml</value>
  </constructor-arg>
</bean>
What are the public methods?
Other than the public init() and setup() methods that used for setting up the service, there are 4 general methods and 1 utility method.

Method Name Type Return Type Results Description
createHashReference() general struct
  • type = hash
  • text = random string
  • hash = hash reference
  • width = width of image
  • height = height of image
Creates a hash reference in the service. Does not actually create a Captcha, but creates a reference so a Captcha can be created in a future request.
createCaptchaFromHashReference() general struct
  • type = hash
  • text = random string
  • hash = hash reference
  • width = width of image
  • height = height of image If argument type is �file�:
  • fileLocation (combination of both fileDirectory and fileName)
  • fileDirectory
  • fileName If argument type is �stream�:
  • stream (Java byte array of image to use with cfcontent)
Creates a captcha to the desired from a hash reference.
createCaptcha() general struct
  • type = hash
  • text = random string
  • hash = hash reference
  • width = width of image
  • height = height of image If argument type is �file�:
  • fileLocation (combination of both fileDirectory and fileName)
  • fileDirectory
  • fileName If argument type is �stream�:
  • stream (Java byte array of image to use with cfcontent)
Creates a captcha to the desired stream.
validateCaptcha() general boolean
  • True
Validates a captcha by hash and user response text.
getAvailableFontNames() utility array   Returns an array of all available system fonts. This is useful when deciding on fonts to use for Captcha configuration.

How do I use a Hash Reference?
The easiest way to use Lyla is to use use Hash References. A Hash Reference in Lyla is a hash (one-way encryption) of the original Captcha text and the salt value as defined in the XML configuration file. When you want to validate a user response, you pass the hash and the user''s response to validateCaptcha() method. The function takes the user�s response and the current salt value and check if it matches the hash reference. If the hashes match, the user entered a correct response.
  1. Create a hash reference using createHashReference().
  2. Use the hash reference in a IMG tage to call a cfm page the actually generates the Captcha image.
    <img src="http://www.example.com/displayCaptcah.cfm?hashReference=#variables.captcha.hash#"/>
    <input name="HashReference" type="hidden" value="#variables.captcha.hash#" />
  3. DisplayCaptcha.cfm uses the passed hashReference url parameter to call createCaptchaFromHashReference() which actually creates the Captcha in the desired output (file or stream) and returns the result structure. This cfm page then returns the Captcha using cfcontent.
  4. Once the user completes the activity that the Captcha guards, you then take the user�s response and the hash the Hash Reference that was stored in a hidden input and pass then to validateCaptcha(). You can then use cflocation, cfthrow or any custom error handling technique if the validation returns false (meaning the user�s response did not match the Captcha text).
Please note the Lyla uses a Least Recently Used (LRU) Cache for Hash References. All Hash References are automatically expired and cleaned up from the service as a period of time. All Hash References are valid from 30 seconds minimum to 60 seconds maximum depending on when the Hash Reference was created in the LRU cleanup cycle. If the page that requires a Hash Reference is a long running page, it is recommended that you create the reference after the long running code so the reference does not expired while the request continues to process.
How do I serve a Captcha using <cfcontent>?
To steam:
  <cfset variables.captcha = variables.cs.createCaptcha("stream") />
  <cfcontent type="image/jpg" variable="#variables.captcha.stream#" reset="false" />

To file:
  <cfset variables.captcha = variables.cs.createCaptcha("file") />
  <cfcontent type="image/jpg" file="#variables.captcha.fileLocation#" deletefile="true" reset="false" />

If you are using hash references, you can use createCaptchaFromHashReference() instead of createCaptcha().
How can I test LylaCaptcha?
Run this code in a file called captchaTest.cfm that is location in the same directory as the LylaCaptcha components:

<cfset variables.cs = CreateObject("component", "captchaService").init(configFile="captcha.xml") />
<cfset variables.cs.setup() />

<cfif StructKeyExists(url, "type") AND url.type EQ "stream">
  <cfset variables.captcha = variables.cs.createCaptcha("stream") />
  <cfcontent type="image/jpg" variable="#variables.captcha.stream#" reset="false" />
<cfelseif StructKeyExists(url, "type") AND url.type EQ "file">
  <cfset variables.captcha = variables.cs.createCaptcha("file") />
  <cfcontent type="image/jpg" file="#variables.captcha.fileLocation#" deletefile="true" reset="false" />
<cfelse>
  <p>Please select a Captcha stream type:</p>
  <ul>
    <li><a href="captchaTest.cfm?type=stream">Stream</a> (Only works on CFMX 7)</li>
    <li><a href="captchaTest.cfm?type=file">File</a></li>
  </ul>
</cfif>
What does the default rendering look like?
LylaCaptcha example 1 LylaCaptcha example 2 LylaCaptcha example 3 LylaCaptcha example 4
Is LylaCaptcha safe for use on non-sticky session server clusters?
Yes. Just be sure that the saltType attribute in the config section of the XML configuration file is set to �defined� and that each server in the cluster has the same saltValue. If you set the saltType to �auto�, a random saltValue is created by the service.
What file formats can LylaCaptcha create?
Currently, LylaCaptcha can only create JPEGs. It cannot currently create PNGs because Java does not ship with an encoder for that file format. Support for PNGs is current in the works. I have no plans to support GIFs.
How many KBs are the files that Lyla creates?
At the default 0.90 JPEG quality, most Captchas at 6-10KBs. Of course, file size depends on the JPEG quality setting.
What about your plans for future versions of LylaCaptcha?
Future plans for Lyla is to implement a background factory and distortion engine.
Who uses LylaCaptcha?
Websites:
  • GreatBizTools (http://www.greatbiztools.com)
    A human resource consulting company that provides �Innovative Solutions for Managing Your Workforce.
  • BeginPage (http://www.beginpage.com)
    A free web portal where users can fully customize the style and every link displayed.
ColdFusion applications: Let me know if you use LylaCaptcha and want to be added to the list. Please include the website address, use type (website or application) and a brief description.
Who does the author want to thank?
My first thank you goes to Mark Mandel from Compound Theory (http://www.compoundtheory.com) for releasing the base code that inspired Lyla Captcha''s first working incarnations. Thank you Mark for all your hard work and your blessings to open source this derivative work.

Secondly, I would like to thank two cflib.org authors for their UDFs which made it into the LylaCaptcha package. A big thanks to Rob Brooks-Bilson for SHA1() and Nathan Dintenfass for ArrayFind().

Thirdly, I'd like to thank my one of my employers - GreatBizTools (http://www.greatbiztools.com) for allowing me to open source LylaCaptcha since I originally wrote the base version for them. My best goes to Denise and Barry for being so supportive of the open source software movement.

Lastly, I'd like to thank dearest Allyson � my partner in crime in life and the light of my life. Thanks honey for letting me stay up late to work on the "non-work" as it is sometimes called here at home.
How can I show my appreciate to the author or supporting the author's Shameless Begging?
If LylaCaptcha proves to be a useful Captcha for you, please consider gifting me something on my Amazon Wishlist: http://www.amazon.com/gp/registry/2NDKJIPDUYE9W

Or you may make a donation with PayPal: pjf@maestropublishing.com

Your generosity is greatly appreciated and thank you for supporting Open Source Software authors.