We've started seeing some odd behaviour this morning - in Chrome on Mac, when the developer tools pa

We've started seeing some odd behaviour this morning - in Chrome on Mac, when the developer tools pane is open, the Turnstile widget seems to not be working (not emulating a different device, just dev tools opened).

Running

turnstile.getResponse()

turnstile.getResponse()

turnstile.getResponse()

turnstile.getResponse() in the console returns

undefined

undefined

, although the usual console logs and network entries appear for Turnstile (eg: the 401 for PAT) - also not seeing an errors in the console. This works on Firefox and Safari.

Closing the developer tools and refreshing the page, everything works.

We're digging into this more from our end - but wondering if anyone else is seeing similar behaviour?

LLeyton We've started seeing some odd behaviour this morning - in Chrome on Mac, when th...

Julian•7/9/24, 3:05 AM

I was going to write exactly what you did. I have been seeing a similar behaviour. Perhaps the CF team changed something?

Julian•7/9/24, 3:05 AM

I have to add that this happens on Mac, Windows and Android.

JJulian I was going to write exactly what you did. I have been seeing a similar behaviou...

LeytonOP•7/9/24, 11:55 AM

Seems others are seeing odd behavour on Chrome at the moment also: https://community.cloudflare.com/t/cloudflare-turnstile-does-not-allow-up-to-90-of-legitimate-traffic/682644

kian•7/9/24, 12:15 PM

https://www.cloudflarestatus.com/incidents/9tlg3xrpssk7

Issues passing Challenge Pages and Turnstile

kian•7/9/24, 12:16 PM

It should have been solved at 2AM UTC today

Original message was deleted

Stingo•7/9/24, 2:16 PM

could you please share the link to this website ?

Kai•7/10/24, 7:05 AM

Is there a way to do pre-clearance in a SPA app, but for cross-origin requests?
WAF rejection will create a CORS error of course, and I'm not aware of a way to set the CORS headers pre-WAF

Master Beast•7/10/24, 7:59 AM

Hi,
Im integrating turnstile captcha in my webapp, is there anyway to customise the captcha to show as invisible on a page and visible on another page?

Original message was deleted

Master Beast•7/10/24, 9:51 AM

so i have to use two different captcha for two different pages right?

Master Beast•7/10/24, 9:55 AM

Ok, Thanks @Leo

I have another query as well, similar to recaptcha will turnstile show any kind of challenge after multiple failed tries?

jeremy•7/10/24, 6:49 PM

Question: may be stupid and I think per this response the answer is yes "You should have some error codes or messages in the body that explain why it's not been verified" but

If the /turnstile/v0/siteverify returns a failed validation response (or basically, "success" is false), is the error-codes array guaranteed to be non-empty (have at least 1 element)?

jeremy•7/10/24, 6:49 PM

Thank you for all y'all work I really love turnstile

miro•7/10/24, 7:18 PM

Hi! I just bought a new pc and try to login in Escape from tarkov website, which uses Cloudflare human verification. And I cant go through it whatever I do. It just doesn't proceed.I don't use any vpn or anything. I tried but it blocks me instantly and doesn't let through. Everything works if I try to open website from phone using the same wi-fi. Please help:bibicat: :bibicat: :bibicat:

miro•7/10/24, 7:25 PM

haha it's all good I just forgot to put right time on a new pc lol

miro•7/10/24, 7:25 PM

thanks anyway!!

Bakri•7/11/24, 9:32 AM

I added invisible turnstile in my form, but sometimes turnstile doesnt add the token!! what do?? how can I verify that user?

Original message was deleted

Bakri•7/11/24, 11:56 AM

how long does it need for captcha to be solved?

Original message was deleted

Bakri•7/11/24, 12:01 PM

why

Original message was deleted

Bakri•7/11/24, 12:02 PM

:MeowHeartCloudflare:

Quentin•7/12/24, 2:26 PM

Hello, a few days ago I noticed that the Turnstile widget had taken a space at the bottom and I looked everywhere in the HTML and CSS and I can't see where it's coming from.
How can I pass this on to the team in charge?

Capture_decran_2024-07-12_a_15.40.08.png

Capture_decran_2024-07-12_a_15.40.15.png

Original message was deleted

Quentin•7/12/24, 3:59 PM

I've just tried it, but it doesn't make any difference.

Quentin•7/12/24, 4:01 PM

Ha yes ok ! Thanks

Master Beast•7/16/24, 6:08 AM

The turnstile script logs data in browser console, is it possible to remove this?

Master Beast•7/17/24, 4:59 AM

My turnstile captcha is behaving as non-interctive in windows system and as interctive in ubuntu system eventhough i chose the interactive type widget mode in captcha settings, how to overcome this issue?

Quentin•7/17/24, 8:44 AM

@Leo Can we tag anyone from the team here?

Quentin•7/17/24, 8:46 AM

Just so someone at Cloudflare can confirm they've seen the problem we're reporting?

Quentin•7/17/24, 8:53 AM

Thanks a lot for these tips!
It would be cool if they fixed the iframe directly, but thanks for your advices

Original message was deleted

jeremy•7/17/24, 9:58 AM

same here

albe00_•7/17/24, 12:09 PM

Hi all, just landing here as I am experiencing a weird issue using turnstile (invisible) on localhost/127.0.0.1; it works nicely on win11/FF128.0, but brave and chrome constantly spit out the following error: TurnstileError: [Cloudflare Turnstile] Error: 600010.
my keys are confirmed correct (they work on FF from the same IP/OS combination) [no extensions are used on either chrome or brave]

MMaster Beast My turnstile captcha is behaving as non-interctive in windows system and as inte...

Master Beast•7/18/24, 5:45 AM

Can anybody help me on this please?

Aalbe00_Hi all, just landing here as I am experiencing a weird issue using turnstile (in...

albe00_•7/18/24, 9:12 AM

Hi is anyone aware of such an issue? the challenge always results in error 600010 on some browsers -- but works on others...?

albe00_•7/18/24, 12:54 PM

hello and thanks -- how do I do that please?

Sslowlorisd Turnstile can’t be configured to be always interactive, I suppose you picked the...

Master Beast•7/18/24, 1:23 PM

Yes, i chose the managed mode to make it interactive, but this mismatched behaviour causes me some problems, is there any way to make it always interactive......

albe00_•7/18/24, 2:20 PM

ho but it is in invisible mode..

albe00_•7/18/24, 2:32 PM

sure I can try that - would it be for a url similar to this one? https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8a532d02d81b948c&lang=auto

Sslowlorisd Can you capture a HAR file with the challenge failing and send it to me?

albe00_•7/18/24, 2:33 PM

ok I have the HAR file - how shall I sent it to you?

albe00_•7/18/24, 3:19 PM

files sent via DM, tyvm

Hugo•7/19/24, 4:55 PM

Hey folks, I'm implementing Turnstile for fetch.

From that doc:

https://blog.cloudflare.com/integrating-turnstile-with-the-cloudflare-waf-to-challenge-fetch-requests

There is an example implementing it overrides the fetch function.

Can a hacker just bypass this by fetching my API using the console with standard fetch?
Is there better way than overriding the fetch function? I want to protect only 1 fetch action in my app

Original message was deleted

Hugo•7/19/24, 5:16 PM

Thanks for your quick reply!

Shay•7/21/24, 11:00 AM

Hi, I'm having trouble implementing turnstile in my Vue app. I am getting an error: TurnstileError: [Cloudflare Turnstile] Error: 110200.

this is my implementation:

Vue:

<div ref="turnstileRef" class="cf-turnstile" data-sitekey="mysitekey" style="display: none;"></div>

const onTurnstileSuccess = async (token) => {
try {
console.log('Verifying Turnstile token:', token);
const response = await verifyTurnstile({ token });

const data = await response.json();

if (data.success) {
console.log('Turnstile verification succeeded');
} else {
console.log('Turnstile verification failed', data.error);
}
} catch (error) {
console.error('Error verifying Turnstile token:', error);
}
};

onMounted(() => {
if (window.turnstile) {
window.turnstile.render(turnstileRef.value, {
sitekey: 'mysitekey',
callback: onTurnstileSuccess
});
}
});

added the script on index.html

Firebase function:

exports.verifyTurnstile = functions.https.onCall(async ({ token }) => {
try {
const response =
process.env.CLOUD_FLARE_SECRET &&
(await fetch(
'https://challenges.cloudflare.com/turnstile/v0/siteverify',
{
method: 'POST',
headers: {
'Content-Type': 'application/x-www-form-urlencoded',
},
body: new URLSearchParams({
secret: process.env.CLOUD_FLARE_SECRET,
response: token,
}),
}
));
const data = response && (await response.json());
if (data.success) {
return { success: true };
} else {
return { success: false, error: data['error-codes'] };
}
} catch (error) {
return { success: false, error: error };
}
});

anyone have an idea what im doing wrong?

Hugo•7/22/24, 3:06 PM

Hi there, still experimenting around Turnstile following the doc: https://blog.cloudflare.com/integrating-turnstile-with-the-cloudflare-waf-to-challenge-fetch-requests

Does the request have to be in credential: 'include' mode?

Hugo•7/22/24, 3:10 PM

Looks like I get the clearance cookie, but at some point it's not passed to alongside the subsequent request (whatever using credential: 'include' or not)

Hugo•7/22/24, 3:21 PM

Implementation looks like:

    async function fetchWithTurnstile(url: string, options: RequestInit): Promise < Response > {
      let response = await fetch(url, options);
      if (
        response.headers.has('cf-mitigated') &&
        response.headers.get('cf-mitigated') === 'challenge'
      ) {
        console.log('Turnstile challenge detected');
        await handleTurnstileChallenge();
        await new Promise((resolve) => setTimeout(resolve, 1000));
        response = await fetch(url, options);
      }

      return response;
    }

    async function fetchWithTurnstile(url: string, options: RequestInit): Promise < Response > {
      let response = await fetch(url, options);
      if (
        response.headers.has('cf-mitigated') &&
        response.headers.get('cf-mitigated') === 'challenge'
      ) {
        console.log('Turnstile challenge detected');
        await handleTurnstileChallenge();
        await new Promise((resolve) => setTimeout(resolve, 1000));
        response = await fetch(url, options);
      }

      return response;
    }

Hugo•7/22/24, 6:11 PM

I think the issue is the cf_clearance cookie is set after the challenge solved with the domain where the challenge was issued.

The user solves the challenge client side on example.com, then the domain field of the cf_clearance cookie is example.com

But I fetch my API at my.api.com so the cookie is not passed.

Maybe that's the problem?

async function fetchWithTurnstile(url: string, options: RequestInit): Promise < Response > { let response = await fetch(url, options); if ( response.headers.has('cf-mitigated') && response.headers.get('cf-mitigated') === 'challenge' ) { console.log('Turnstile challenge detected'); await handleTurnstileChallenge(); await new Promise((resolve) => setTimeout(resolve, 1000)); response = await fetch(url, options); } return response; }

We've started seeing some odd behaviour this morning - in Chrome on Mac, when the developer tools pa

Similar Threads

Similar Threads

Similar Threads