Consume spinner token from session

[dmrAnderson]

Currently, the invisible_captcha_timestamp is explicitly consumed and removed from the session during validation, but the invisible_captcha_spinner is only read.

While this doesn't impact failed/spam requests, it creates an issue on successful form submissions.
Because the invisible_captcha_spinner token is never deleted, it lingers in the user's session cookie indefinitely as stale data.

[markets]

Hey @dmrAnderson I think we already delete this value in another place:

invisible_captcha/lib/invisible_captcha/controller_ext.rb

Line 58 in 2a9ea33

timestamp = session.delete(:invisible_captcha_timestamp)

Not sure if this is necessary 🤔

[dmrAnderson]

Hi!
Thanks for the quick reply!
During a successful request:

• invisible_captcha_timestamp is cleanly deleted from the session.
• invisible_captcha_spinner is verified, but remains in the session.