Issue #2992697 by elachlan: Testing failing on 8.x Branch

captcha.module

@@ -418,16 +418,9 @@ function _captcha_get_posted_captcha_info(array $element, FormStateInterface $fo
               '@posted_captcha_token' => var_export($posted_captcha_token, TRUE),
             ]
           );
-
+          // Invalidate the CAPTCHA session.
           $posted_captcha_sid = NULL;
         }
-        // Invalidate CAPTCHA token to avoid reuse.
-        if (!empty($posted_captcha_sid)) {
-          \Drupal::database()->update('captcha_sessions')
-            ->fields(['token' => NULL])
-            ->condition('csid', $posted_captcha_sid)
-            ->execute();
-        }
       }
     }
     else {

src/Element/Captcha.php

@@ -129,12 +129,7 @@ class Captcha extends FormElement implements ContainerFactoryPluginInterface {
       '#value' => $captcha_sid,
     ];
 
-    // Additional one time CAPTCHA token: store in database and send with form.
-    // $captcha_token = hash('sha256', mt_rand());
-    // db_update('captcha_sessions')
-    // ->fields(['token' => $captcha_token])
-    // ->condition('csid', $captcha_sid)
-    // ->execute();
+    // Store CAPTCHA token as hidden field.
     $captcha_token = \Drupal::database()
       ->select('captcha_sessions', 'cs')
       ->fields('cs', ['token'])