We've implemented a captcha test which works well when saving state on the client. However, if the state is set in web.xml to be saved server side:

<context-param>
 <param-name>javax.faces.STATE_SAVING_METHOD</param-name>
 <param-value>server</param-value>
</context-param>

Then the captcha test fails. Running a debugger I can see that the org.jboss.seam.captcha.Captcha.validateResponse(String response) method is actually called several times. The first time, the response is correct and the method returns true, however the method is then called again with the same response without redisplaying the page. This time of course the answer has changed so the response fails and the page is redisplayed. Each subsequent time the page is submitted the number of times the validateResponse method is called increases by 1.

I'm curious to know what is going on here. Also, I notice that when running Seam we often see acessor methods and constructors called several times; is this related I wonder?