+ * A [EMAIL PROTECTED] Field} for CAPTCHA validation. Upon generation, a secret random string is stored
+ * in a session attribute having the same name as the field's ID, for use by a + * [EMAIL PROTECTED] org.apache.cocoon.forms.validation.impl.CaptchaValidator}.
+ Session session = ObjectModelHelper.getRequest(objectModel).getSession(true); + session.setAttribute(SESSION_ATTR_PREFIX + getId(), generateSecret());
Such session attribute name is not unique (two forms with similar widget id). Why not use widget.set/getAttribute?
Vadim
