Submitted by: abisurd
Captcha should be1. Human-readable but not computer-readable
2. Have non-dictionary words
3. Have no offensive words
4. Should be sufficiently random
Base your test cases around these requirements.
1 is not very easy to verify, but there may be automated tests that can try (and fail) to make sense of the captcha. For this, input paramaeters would be captcha words/numbers and the text part of it.
2. Can be testing using the API and a representative dictionary.
3. Similar to 2 above, but with a dictionary of offensive words.
4. Run batches of a large number of runs of the Captcha API and store the 'words' returned. Find how many 'words' returned are common between batches. How many is acceptable depends on project management, complexity, security situation.
Above answer was rated as good by the following members:
rajmohan23