Help with Jot Captcha

Ok, I have a strange problem which I think I know why it happens but I am not sure how I can fix it.

Let me give some background. I have a Modx site the allow users to enter comments on articles using Jot.

The same site is been used as a Facebook application, this is the same site but with a different template to make it render correctly in Facebook.

The original site is at www.howirritating.com and the captcha works fine, allows comments to be added. The call back url that is used be Facebook is apps.howirritating.com and the Facebook app the uses this call back is apps.facebook.com/howirritating

Everything seems fine apart from the captcha’s, always says you have entered the wrong value unless the form are access from the www. url.

I am assuming that the captcha code does not like the fact that I am calling it from Facebook, does anyone have any ideas how I can work around this?

Thanks in advance
Ian

The CAPTCHA part saves the correct answer in a SESSION variable after displaying the image. Later, the user’s input is checked against that SESSION variable. I’m guessing that SESSION variable isn’t available where it’s being checked.

Bob

The session cookie depends on the domain. mydomain.com is a different domain than www.mydomain.com. There is a parameter when creating a cookie to configure it to accept www. or anything. as the same as mydomain, but I believe the MODx session cookies don’t do it that way; subdomains like www. are considered as different domains.

Quote from: sottwell at Jul 10, 2008, 03:39 PM

The session cookie depends on the domain. mydomain.com is a different domain than www.mydomain.com. There is a parameter when creating a cookie to configure it to accept www. or anything. as the same as mydomain, but I believe the MODx session cookies don’t do it that way; subdomains like www. are considered as different domains.

Would the rewrite rule changing www.domain.com to domain.com in .htaccess solve this?

I don’t think so, the request has already come in and the rewrite is changing it from one to the other. I think the cookie comes with the page request, and depends on the url requested. I may be wrong about that... maybe this calls for some more research on exactly how cookies work.

From one source http://wp.netscape.com/newsref/std/cookie_spec.html

Any future HTTP requests made by the client which fall in that range will include a transmittal of the current value of the state object from the client back to the server.

So it looks like if the cookie was set to be valid for "domain.com" and now the browser is requesting "www.domain.com" it won’t send the cookie, and the rewrite won’t make any difference.

And this from MSDN:

The Cookie header is included by the client application with an HTTP request sent to a server, if there is a cookie that has a matching domain and path.

More information here: http://www.php.net/setcookie