# Keycloak AuthenticationFlowContext context - Session value

**URL:** <https://forum.keycloak.org/t/keycloak-authenticationflowcontext-context-session-value/8437>\
**Category:** Extending the server\
**Tags:** authentication\
**Created:** [April 11, 2021, 10:57am UTC](https://forum.keycloak.org/t/keycloak-authenticationflowcontext-context-session-value/8437 "2021-04-11T10:57:30Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![kcuser](https://avatars.discourse-cdn.com/v4/letter/k/71c47a/32.png) [@kcuser](https://forum.keycloak.org/u/kcuser)\
**Post date:** [April 11, 2021, 10:57am UTC](https://forum.keycloak.org/t/keycloak-authenticationflowcontext-context-session-value/8437/1 "2021-04-11T10:57:30Z")

</div>

Hi,

I’ve created a custom brower login provider which extends `UsernamePasswordForm` to include a Captcha button like the option that’s in place on the Keycloak registration setup, it’s loosely based on this one but with various modifications:

> **[raptor-group/keycloak-login-recaptcha](https://github.com/raptor-group/keycloak-login-recaptcha)**
>
> By default Keycloak (up to 12) only supports ReCaptcha for Regsitration, not login. so we created a simple module for activating recaptcha for login

All is working well with it but I want to add one addition that saves to session the fact that the user has completed the Captcha once so that they don’t need to submit it again until their next browser visit (eg if they get their password wrong but the captcha correct, they don’t have to do the Captcha again until the next time they open their browser).

I’ve tried this using the KeycloakSession object on the AuthenticationFlowContext, eg:

```
KeycloakSession session = context.getSession();
session.setAttribute("LOGIN_RECAPTCHA_PASSED", true);

```

But this session value doesn’t seem to persist for future visits (eg a page refresh or another postback after the first one), when using `session.getAttribute("LOGIN_RECAPTCHA_PASSED")` the value isn’t maintained - is this going to be possible? I was hoping to do this in session so that it can’t be tampered with and the fact that it can be held until the user comes back in future visits.

Hopefully that makes sense.

Steve