From what I understand, when a user completes a captcha, you set a session cookie, using resty.session, which I assume is this library: https://github.com/bungl

From what I understand, when a user completes a captcha, you set a session cookie, using resty.session, which I assume is this library: https://github.com/bungle/lua-resty-session https://github.com/bungle/lua-resty-session According to its readme, it does not check IP addresses, which means an attacker can just complete the CAPTCHA once, and copy their session to as many computers as they like. So you probably want to set session_check_addr. But I've never used resty or lua, so I may be misreading how your code works.