Ssorry, what do you mean by that?
SI Have seen a service that does verify clearance for json endpoint , so yes its possible
Sit is.
Swell can json endpoints be protected by waf ?
Sthen it is possible
IIt's not possible to do it in your Worker though.
IIf the cookie is rejected the Worker will never be invoked so will never know it was rejected.
IYou can certainly protect a Worker, just not validate in the Worker.
Sdoes the turnstile cf_clearance cookie mean that the request.cf.botManagement.js_detection.passed field will be set to "true"?
Sit would be helpful if once a challenge or turnstile is passed that field was set to "true"
Cit's best practice to store a turnstile secret key in the wrangler.toml secrets space right?
ISecrets are not stored in wrangler.toml (they're manually added via
wrangler secrets put), but yes.IWrangler.toml is plain-text and non-encrypted, so secrets are better for storing keys.
Cahh ok
Cthanks!
Calong those lines, how do I access a secret in a page function? it doesn't seem to be passed in through the env variable through the fetch request
Cat least, when I iterate through the env object, it doesn't seem to have my secret
HHave you tried accessing the secret directly, rather than iterating?
Cyeah I get null when I log it. maybeeee it's because CF obfuscates my secret when put through a console log but my turnstile is failing so I'm trying to debug through that
CI'm accessing it as env.SECRET_KEY (I know the env variable is being assigned correctly because I have a KV binding that works from it)
Chm ok to "confirm" I'm not getting the right secret value, this is the error code from site verify
C"error-codes -> invalid-input-secret"
Cargghhh ok. I think it's because I tried entering the secret through wrangler
Cwent through the CF dashboard and the secret seems to be available. But I had run
wrangler secret put SECRET_KEY and even though it seemed to push the secret, it doesn't seem like it worked
Sit would be really helpful either having a clearance cookie set the js detections field to true or if there was a seperate "is_cleared" bot management field avaiable in workers
Sunfortunatley turning on js detections for the whole zone causes issues in webviews, so we may have to resort to creating custom clearance cookie in rate limiting workers, which is far from ideal
Swe probably will, it will most likely just be less sophisticated than cloudflare's implementation
IIs there a way to make Turnstile work from a desktop app? I tried registering the app's URL schema in the domain settings (say it's
My Supabase Auth requires Turnstile captcha token to be passed in, so can't really skip that in the desktop app login.
app.electron://, so I added app.electron), but still get the Invalid domain error when the app is packaged.My Supabase Auth requires Turnstile captcha token to be passed in, so can't really skip that in the desktop app login.
FI'm not sure but maybe login in a spawned browser window?
JHi everyone ,
I have an issue with turnstile . I have made an issue in the community website : https://community.cloudflare.com/t/cannot-initialize-widget-element-not-found/666742
Is it possible to get more help ?
Thanks in advance
I have an issue with turnstile . I have made an issue in the community website : https://community.cloudflare.com/t/cannot-initialize-widget-element-not-found/666742
Is it possible to get more help ?
Thanks in advance
Jcan I ask why ? :bibicat:
SIs it possible to get a sitekey without having a registered website (in the websites section) on cf?
JThanks @Leo , fixed my issue using
slotsCI built a turnstile in a dev environemnt but I had the key hardcoded in the HTML. is the best practice to define the keys by environment in the wrangler.toml file?
Cbut how would I flip it per environment?
Cyeah but I have a sitekey for dev and a sitekey for prod. Somehow I'd need to identify the environment to populate the turnstile element with the relevant sitekey. Tryign to think of how
Cok I found
NEXT_PUBLIC_ should work but is this a best practice for turnstiles? I can't find any documentation on nitCwell the sitekey needs to align with the domain, no? so if I have a preview and prod environment (prod would be a custom domain in this case) I would need different sitekeys for both
Cif I hardcode my preview sitekey in the turnstile, my prod turnstile won't work (I get this error)
C
EYou can add multiple domains, and if you add a domain then all subdomains are included automatically.
So for a Pages project for example just add
So for a Pages project for example just add
example.com and example.pages.dev and youre good to go with one sitekey