Hi all, just landing here as I am experiencing a weird issue using turnstile (invisible) on localhos

Hi all, just landing here as I am experiencing a weird issue using turnstile (invisible) on localhost/127.0.0.1; it works nicely on win11/FF128.0, but brave and chrome constantly spit out the following error: TurnstileError: [Cloudflare Turnstile] Error: 600010.
my keys are confirmed correct (they work on FF from the same IP/OS combination) [no extensions are used on either chrome or brave]

MMaster Beast My turnstile captcha is behaving as non-interctive in windows system and as inte...

Master Beast•7/18/24, 5:45 AM

Can anybody help me on this please?

Aalbe00_Hi all, just landing here as I am experiencing a weird issue using turnstile (in...

albe00_OP•7/18/24, 9:12 AM

Hi is anyone aware of such an issue? the challenge always results in error 600010 on some browsers -- but works on others...?

albe00_OP•7/18/24, 12:54 PM

hello and thanks -- how do I do that please?

Sslowlorisd Turnstile can’t be configured to be always interactive, I suppose you picked the...

Master Beast•7/18/24, 1:23 PM

Yes, i chose the managed mode to make it interactive, but this mismatched behaviour causes me some problems, is there any way to make it always interactive......

albe00_OP•7/18/24, 2:20 PM

ho but it is in invisible mode..

albe00_OP•7/18/24, 2:32 PM

sure I can try that - would it be for a url similar to this one? https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8a532d02d81b948c&lang=auto

Sslowlorisd Can you capture a HAR file with the challenge failing and send it to me?

albe00_OP•7/18/24, 2:33 PM

ok I have the HAR file - how shall I sent it to you?

albe00_OP•7/18/24, 3:19 PM

files sent via DM, tyvm

Hugo•7/19/24, 4:55 PM

Hey folks, I'm implementing Turnstile for fetch.

From that doc:

https://blog.cloudflare.com/integrating-turnstile-with-the-cloudflare-waf-to-challenge-fetch-requests

There is an example implementing it overrides the fetch function.

Can a hacker just bypass this by fetching my API using the console with standard fetch?
Is there better way than overriding the fetch function? I want to protect only 1 fetch action in my app

Original message was deleted

Hugo•7/19/24, 5:16 PM

Thanks for your quick reply!

Shay•7/21/24, 11:00 AM

Hi, I'm having trouble implementing turnstile in my Vue app. I am getting an error: TurnstileError: [Cloudflare Turnstile] Error: 110200.

this is my implementation:

Vue:

<div ref="turnstileRef" class="cf-turnstile" data-sitekey="mysitekey" style="display: none;"></div>

const onTurnstileSuccess = async (token) => {
try {
console.log('Verifying Turnstile token:', token);
const response = await verifyTurnstile({ token });

const data = await response.json();

if (data.success) {
console.log('Turnstile verification succeeded');
} else {
console.log('Turnstile verification failed', data.error);
}
} catch (error) {
console.error('Error verifying Turnstile token:', error);
}
};

onMounted(() => {
if (window.turnstile) {
window.turnstile.render(turnstileRef.value, {
sitekey: 'mysitekey',
callback: onTurnstileSuccess
});
}
});

added the script on index.html

Firebase function:

exports.verifyTurnstile = functions.https.onCall(async ({ token }) => {
try {
const response =
process.env.CLOUD_FLARE_SECRET &&
(await fetch(
'https://challenges.cloudflare.com/turnstile/v0/siteverify',
{
method: 'POST',
headers: {
'Content-Type': 'application/x-www-form-urlencoded',
},
body: new URLSearchParams({
secret: process.env.CLOUD_FLARE_SECRET,
response: token,
}),
}
));
const data = response && (await response.json());
if (data.success) {
return { success: true };
} else {
return { success: false, error: data['error-codes'] };
}
} catch (error) {
return { success: false, error: error };
}
});

anyone have an idea what im doing wrong?

Hugo•7/22/24, 3:06 PM

Hi there, still experimenting around Turnstile following the doc: https://blog.cloudflare.com/integrating-turnstile-with-the-cloudflare-waf-to-challenge-fetch-requests

Does the request have to be in credential: 'include' mode?

Hugo•7/22/24, 3:10 PM

Looks like I get the clearance cookie, but at some point it's not passed to alongside the subsequent request (whatever using credential: 'include' or not)

Hugo•7/22/24, 3:21 PM

Implementation looks like:

    async function fetchWithTurnstile(url: string, options: RequestInit): Promise < Response > {
      let response = await fetch(url, options);
      if (
        response.headers.has('cf-mitigated') &&
        response.headers.get('cf-mitigated') === 'challenge'
      ) {
        console.log('Turnstile challenge detected');
        await handleTurnstileChallenge();
        await new Promise((resolve) => setTimeout(resolve, 1000));
        response = await fetch(url, options);
      }

      return response;
    }

    async function fetchWithTurnstile(url: string, options: RequestInit): Promise < Response > {
      let response = await fetch(url, options);
      if (
        response.headers.has('cf-mitigated') &&
        response.headers.get('cf-mitigated') === 'challenge'
      ) {
        console.log('Turnstile challenge detected');
        await handleTurnstileChallenge();
        await new Promise((resolve) => setTimeout(resolve, 1000));
        response = await fetch(url, options);
      }

      return response;
    }

Hugo•7/22/24, 6:11 PM

I think the issue is the cf_clearance cookie is set after the challenge solved with the domain where the challenge was issued.

The user solves the challenge client side on example.com, then the domain field of the cf_clearance cookie is example.com

But I fetch my API at my.api.com so the cookie is not passed.

Maybe that's the problem?

Original message was deleted

Hugo•7/22/24, 6:42 PM

I tried using credentials: include, same, the cookie is correctly set in the client (challenge solved on example.com), but not passed alongside requests to api.example.com

Original message was deleted

Hugo•7/22/24, 6:50 PM

Actually it's not even showing up in that list, even in filtered one. Maybe that's a partition thing?

Original message was deleted

Hugo•7/22/24, 6:54 PM

Both the POST and OPTIONS don't include it

Original message was deleted

Hugo•7/22/24, 6:56 PM

OPTIONS is 200, then the POST is 403, challenged. While I have the cf_clearance cookie set in the browser + credentials on 'include'

Original message was deleted

Hugo•7/22/24, 7:04 PM

I'm probably missing something, but that's what I have, an 200 OPTIONS, a 403 POST, a cf_clearance that is not passed through

Original message was deleted

Hugo•7/22/24, 7:13 PM

I set a dynamic rule for that, otherwise it was blocked like this

Original message was deleted

Hugo•7/22/24, 7:24 PM

exactly!

Original message was deleted

Hugo•7/22/24, 7:24 PM

yep

Hugo•7/22/24, 7:25 PM

yeah so it should be the same domain

Hugo•7/22/24, 7:27 PM

Yep so the domain field of the cookie will be example.com, then with credential mode, the call to api.example.com will pass the cookie

Original message was deleted

Hugo•7/22/24, 7:40 PM

have you other folks in that situation? We develop a new feature deployed on something.pages.dev, but we have to call our backends at api.example.com. In the context of Turnstile for fetch.

Original message was deleted

Hugo•7/22/24, 8:40 PM

Nice idea !

ks•7/23/24, 1:40 PM

Hi guys, need some help here. I'm getting SSL error when my azure app service trying to call the https://challenges.cloudflare.com/turnstile/v0/siteverify

System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.

System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.

Any idea how we can fix it?

Jonny•7/25/24, 5:52 AM

Hello! mates

Jonny•7/25/24, 5:52 AM

I keep getting this error when verifying humanity.

Jonny•7/25/24, 5:52 AM

Could you help?

Jonny•7/25/24, 5:52 AM

8a89e23fef676889

Jonny•7/25/24, 5:52 AM

RayID

Jonny•7/25/24, 5:52 AM

Thanks

Jonny•7/25/24, 5:52 AM

It happened from 3 days ago

Jonny•7/25/24, 5:54 AM

8a89e57029b429d2 as well

abocsan•7/25/24, 7:01 AM

Hello! I am encountering an issue on a production environment regarding the console opening a debugger statement for a few seconds when turnstile is visible and have the console opened. This can be reproduced also here: https://dash.cloudflare.com/login is there any way to disable that ?

Sebastian•7/25/24, 7:06 AM

has there been any updates on turnstile adding an entry to browser history every time it refreshes

Sebastian•7/25/24, 7:07 AM

or maybe a workaround to make it not do that

Sslowlorisd Do you have any extension in your browser?

Jonny•7/25/24, 7:51 AM

a lot, I am a crypto user.

async function fetchWithTurnstile(url: string, options: RequestInit): Promise < Response > { let response = await fetch(url, options); if ( response.headers.has('cf-mitigated') && response.headers.get('cf-mitigated') === 'challenge' ) { console.log('Turnstile challenge detected'); await handleTurnstileChallenge(); await new Promise((resolve) => setTimeout(resolve, 1000)); response = await fetch(url, options); } return response; }

System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.

Hi all, just landing here as I am experiencing a weird issue using turnstile (invisible) on localhos

Similar Threads

Similar Threads

Similar Threads