I was going to write exactly what you did. I have been seeing a similar behaviour. Perhaps the CF te
I was going to write exactly what you did. I have been seeing a similar behaviour. Perhaps the CF team changed something?
JI have to add that this happens on Mac, Windows and Android.
LSeems others are seeing odd behavour on Chrome at the moment also: https://community.cloudflare.com/t/cloudflare-turnstile-does-not-allow-up-to-90-of-legitimate-traffic/682644
KIt should have been solved at 2AM UTC today
Scould you please share the link to this website ?
KIs there a way to do pre-clearance in a SPA app, but for cross-origin requests?
WAF rejection will create a CORS error of course, and I'm not aware of a way to set the CORS headers pre-WAF
WAF rejection will create a CORS error of course, and I'm not aware of a way to set the CORS headers pre-WAF
MHi,
Im integrating turnstile captcha in my webapp, is there anyway to customise the captcha to show as invisible on a page and visible on another page?
Im integrating turnstile captcha in my webapp, is there anyway to customise the captcha to show as invisible on a page and visible on another page?
Mso i have to use two different captcha for two different pages right?
MOk, Thanks @Leo
I have another query as well, similar to recaptcha will turnstile show any kind of challenge after multiple failed tries?
I have another query as well, similar to recaptcha will turnstile show any kind of challenge after multiple failed tries?
JQuestion: may be stupid and I think per this response the answer is yes "You should have some error codes or messages in the body that explain why it's not been verified" but
If the /turnstile/v0/siteverify returns a failed validation response (or basically, "success" is false), is the error-codes array guaranteed to be non-empty (have at least 1 element)?
If the /turnstile/v0/siteverify returns a failed validation response (or basically, "success" is false), is the error-codes array guaranteed to be non-empty (have at least 1 element)?
JThank you for all y'all work I really love turnstile
MHi! I just bought a new pc and try to login in Escape from tarkov website, which uses Cloudflare human verification. And I cant go through it whatever I do. It just doesn't proceed.I don't use any vpn or anything. I tried but it blocks me instantly and doesn't let through. Everything works if I try to open website from phone using the same wi-fi. Please help:bibicat: :bibicat: :bibicat:
Mhaha it's all good I just forgot to put right time on a new pc lol
Mthanks anyway!!
BI added invisible turnstile in my form, but sometimes turnstile doesnt add the token!! what do?? how can I verify that user?
Bhow long does it need for captcha to be solved?
Bwhy 
B
B:MeowHeartCloudflare:
QHello, a few days ago I noticed that the Turnstile widget had taken a space at the bottom and I looked everywhere in the HTML and CSS and I can't see where it's coming from.
How can I pass this on to the team in charge?
How can I pass this on to the team in charge?
QI've just tried it, but it doesn't make any difference.
QHa yes ok ! Thanks
MThe turnstile script logs data in browser console, is it possible to remove this?
MMy turnstile captcha is behaving as non-interctive in windows system and as interctive in ubuntu system eventhough i chose the interactive type widget mode in captcha settings, how to overcome this issue?
Q@Leo Can we tag anyone from the team here?
QJust so someone at Cloudflare can confirm they've seen the problem we're reporting?
QThanks a lot for these tips!
It would be cool if they fixed the iframe directly, but thanks for your advices
It would be cool if they fixed the iframe directly, but thanks for your advices
Jsame here
AHi all, just landing here as I am experiencing a weird issue using turnstile (invisible) on localhost/127.0.0.1; it works nicely on win11/FF128.0, but brave and chrome constantly spit out the following error: TurnstileError: [Cloudflare Turnstile] Error: 600010.
my keys are confirmed correct (they work on FF from the same IP/OS combination) [no extensions are used on either chrome or brave]
my keys are confirmed correct (they work on FF from the same IP/OS combination) [no extensions are used on either chrome or brave]
MCan anybody help me on this please?
AHi is anyone aware of such an issue? the challenge always results in error 600010 on some browsers -- but works on others...?
Ahello and thanks -- how do I do that please? 
MYes, i chose the managed mode to make it interactive, but this mismatched behaviour causes me some problems, is there any way to make it always interactive......
Aho but it is in invisible mode..
Asure I can try that - would it be for a url similar to this one? https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8a532d02d81b948c&lang=auto
Aok I have the HAR file - how shall I sent it to you?
Afiles sent via DM, tyvm
HHey folks, I'm implementing Turnstile for fetch.
From that doc:
https://blog.cloudflare.com/integrating-turnstile-with-the-cloudflare-waf-to-challenge-fetch-requests
There is an example implementing it overrides the fetch function.
From that doc:
https://blog.cloudflare.com/integrating-turnstile-with-the-cloudflare-waf-to-challenge-fetch-requests
There is an example implementing it overrides the fetch function.
- Can a hacker just bypass this by fetching my API using the console with standard fetch?
- Is there better way than overriding the fetch function? I want to protect only 1 fetch action in my app
HThanks for your quick reply!
SHi, I'm having trouble implementing turnstile in my Vue app. I am getting an error: TurnstileError: [Cloudflare Turnstile] Error: 110200.
this is my implementation:
Vue:
<div ref="turnstileRef" class="cf-turnstile" data-sitekey="mysitekey" style="display: none;"></div>
const onTurnstileSuccess = async (token) => {
try {
console.log('Verifying Turnstile token:', token);
const response = await verifyTurnstile({ token });
const data = await response.json();
if (data.success) {
console.log('Turnstile verification succeeded');
} else {
console.log('Turnstile verification failed', data.error);
}
} catch (error) {
console.error('Error verifying Turnstile token:', error);
}
};
onMounted(() => {
if (window.turnstile) {
window.turnstile.render(turnstileRef.value, {
sitekey: 'mysitekey',
callback: onTurnstileSuccess
});
}
});
added the script on index.html
Firebase function:
exports.verifyTurnstile = functions.https.onCall(async ({ token }) => {
try {
const response =
process.env.CLOUD_FLARE_SECRET &&
(await fetch(
'https://challenges.cloudflare.com/turnstile/v0/siteverify',
{
method: 'POST',
headers: {
'Content-Type': 'application/x-www-form-urlencoded',
},
body: new URLSearchParams({
secret: process.env.CLOUD_FLARE_SECRET,
response: token,
}),
}
));
const data = response && (await response.json());
if (data.success) {
return { success: true };
} else {
return { success: false, error: data['error-codes'] };
}
} catch (error) {
return { success: false, error: error };
}
});
anyone have an idea what im doing wrong?
this is my implementation:
Vue:
<div ref="turnstileRef" class="cf-turnstile" data-sitekey="mysitekey" style="display: none;"></div>
const onTurnstileSuccess = async (token) => {
try {
console.log('Verifying Turnstile token:', token);
const response = await verifyTurnstile({ token });
const data = await response.json();
if (data.success) {
console.log('Turnstile verification succeeded');
} else {
console.log('Turnstile verification failed', data.error);
}
} catch (error) {
console.error('Error verifying Turnstile token:', error);
}
};
onMounted(() => {
if (window.turnstile) {
window.turnstile.render(turnstileRef.value, {
sitekey: 'mysitekey',
callback: onTurnstileSuccess
});
}
});
added the script on index.html
Firebase function:
exports.verifyTurnstile = functions.https.onCall(async ({ token }) => {
try {
const response =
process.env.CLOUD_FLARE_SECRET &&
(await fetch(
'https://challenges.cloudflare.com/turnstile/v0/siteverify',
{
method: 'POST',
headers: {
'Content-Type': 'application/x-www-form-urlencoded',
},
body: new URLSearchParams({
secret: process.env.CLOUD_FLARE_SECRET,
response: token,
}),
}
));
const data = response && (await response.json());
if (data.success) {
return { success: true };
} else {
return { success: false, error: data['error-codes'] };
}
} catch (error) {
return { success: false, error: error };
}
});
anyone have an idea what im doing wrong?
HHi there, still experimenting around Turnstile following the doc: https://blog.cloudflare.com/integrating-turnstile-with-the-cloudflare-waf-to-challenge-fetch-requests
Does the request have to be in credential: 'include' mode?
Does the request have to be in credential: 'include' mode?
HLooks like I get the clearance cookie, but at some point it's not passed to alongside the subsequent request (whatever using credential: 'include' or not)
HImplementation looks like:
HI think the issue is the cf_clearance cookie is set after the challenge solved with the domain where the challenge was issued.
The user solves the challenge client side on example.com, then the domain field of the cf_clearance cookie is example.com
But I fetch my API at my.api.com so the cookie is not passed.
Maybe that's the problem?
The user solves the challenge client side on example.com, then the domain field of the cf_clearance cookie is example.com
But I fetch my API at my.api.com so the cookie is not passed.
Maybe that's the problem?
HI tried using credentials: include, same, the cookie is correctly set in the client (challenge solved on example.com), but not passed alongside requests to api.example.com