Design an interface that can be used by pure Java captchas and can support PNG, GIF, APNG, etc about lc-core HOT 3 CLOSED

The tradeoff we are considering is: allowing the captcha provider to return a BLOB will simplify the interface, but the downside in security is uncertain.

One possible solution: the framework can let the Captcha provider return a list of images. If there is only one image in the list, then the framework can encode to PNG, else encode to GIF / APNG.

Going into details, the Captcha provider needs to return a list of (Image, Duration) tuples. The duration is the time in milliseconds that the frame should be visible. Further information could be added such as a clear flag, that will clear the accumulated frame before compositing the next frame.

from lc-core.

Security wise, I think the risk is minimal. The browser is going to be the only consumer of the BLOB returned by the Captcha provider, and browsers already need to defend against malignant image payloads.

If, in the future, other consumers need to read the BLOB, then we can revisit this issue.

from lc-core.

closed via #12

from lc-core.