files sent via DM, tyvm 🙂

H

Hugo•7/19/24, 4:55 PM

Hey folks, I'm implementing Turnstile for fetch.

From that doc:

https://blog.cloudflare.com/integrating-turnstile-with-the-cloudflare-waf-to-challenge-fetch-requests

There is an example implementing it overrides the fetch function.

Can a hacker just bypass this by fetching my API using the console with standard fetch?
Is there better way than overriding the fetch function? I want to protect only 1 fetch action in my app

Original message was deleted

H

Hugo•7/19/24, 5:16 PM

Thanks for your quick reply!

S

Shay•7/21/24, 11:00 AM

Hi, I'm having trouble implementing turnstile in my Vue app. I am getting an error: TurnstileError: [Cloudflare Turnstile] Error: 110200.

this is my implementation:

Vue:

<div ref="turnstileRef" class="cf-turnstile" data-sitekey="mysitekey" style="display: none;"></div>

const onTurnstileSuccess = async (token) => {
try {
console.log('Verifying Turnstile token:', token);
const response = await verifyTurnstile({ token });

const data = await response.json();

if (data.success) {
console.log('Turnstile verification succeeded');
} else {
console.log('Turnstile verification failed', data.error);
}
} catch (error) {
console.error('Error verifying Turnstile token:', error);
}
};

onMounted(() => {
if (window.turnstile) {
window.turnstile.render(turnstileRef.value, {
sitekey: 'mysitekey',
callback: onTurnstileSuccess
});
}
});

added the script on index.html

Firebase function:

exports.verifyTurnstile = functions.https.onCall(async ({ token }) => {
try {
const response =
process.env.CLOUD_FLARE_SECRET &&
(await fetch(
'https://challenges.cloudflare.com/turnstile/v0/siteverify',
{
method: 'POST',
headers: {
'Content-Type': 'application/x-www-form-urlencoded',
},
body: new URLSearchParams({
secret: process.env.CLOUD_FLARE_SECRET,
response: token,
}),
}
));
const data = response && (await response.json());
if (data.success) {
return { success: true };
} else {
return { success: false, error: data['error-codes'] };
}
} catch (error) {
return { success: false, error: error };
}
});

anyone have an idea what im doing wrong?

H

Hugo•7/22/24, 3:06 PM

Hi there, still experimenting around Turnstile following the doc: https://blog.cloudflare.com/integrating-turnstile-with-the-cloudflare-waf-to-challenge-fetch-requests

Does the request have to be in credential: 'include' mode?

H

Hugo•7/22/24, 3:10 PM

Looks like I get the clearance cookie, but at some point it's not passed to alongside the subsequent request (whatever using credential: 'include' or not)

H

Hugo•7/22/24, 3:21 PM

Implementation looks like:

    async function fetchWithTurnstile(url: string, options: RequestInit): Promise < Response > {
      let response = await fetch(url, options);
      if (
        response.headers.has('cf-mitigated') &&
        response.headers.get('cf-mitigated') === 'challenge'
      ) {
        console.log('Turnstile challenge detected');
        await handleTurnstileChallenge();
        await new Promise((resolve) => setTimeout(resolve, 1000));
        response = await fetch(url, options);
      }

      return response;
    }

    async function fetchWithTurnstile(url: string, options: RequestInit): Promise < Response > {
      let response = await fetch(url, options);
      if (
        response.headers.has('cf-mitigated') &&
        response.headers.get('cf-mitigated') === 'challenge'
      ) {
        console.log('Turnstile challenge detected');
        await handleTurnstileChallenge();
        await new Promise((resolve) => setTimeout(resolve, 1000));
        response = await fetch(url, options);
      }

      return response;
    }

    async function fetchWithTurnstile(url: string, options: RequestInit): Promise < Response > {
      let response = await fetch(url, options);
      if (
        response.headers.has('cf-mitigated') &&
        response.headers.get('cf-mitigated') === 'challenge'
      ) {
        console.log('Turnstile challenge detected');
        await handleTurnstileChallenge();
        await new Promise((resolve) => setTimeout(resolve, 1000));
        response = await fetch(url, options);
      }

      return response;
    }

    async function fetchWithTurnstile(url: string, options: RequestInit): Promise < Response > {
      let response = await fetch(url, options);
      if (
        response.headers.has('cf-mitigated') &&
        response.headers.get('cf-mitigated') === 'challenge'
      ) {
        console.log('Turnstile challenge detected');
        await handleTurnstileChallenge();
        await new Promise((resolve) => setTimeout(resolve, 1000));
        response = await fetch(url, options);
      }

      return response;
    }

H

Hugo•7/22/24, 6:11 PM

I think the issue is the cf_clearance cookie is set after the challenge solved with the domain where the challenge was issued.

The user solves the challenge client side on example.com, then the domain field of the cf_clearance cookie is example.com

But I fetch my API at my.api.com so the cookie is not passed.

Maybe that's the problem?

Original message was deleted

H

Hugo•7/22/24, 6:42 PM

I tried using credentials: include, same, the cookie is correctly set in the client (challenge solved on example.com), but not passed alongside requests to api.example.com

Original message was deleted

H

Hugo•7/22/24, 6:50 PM

Actually it's not even showing up in that list, even in filtered one. Maybe that's a partition thing?

Original message was deleted

H

Hugo•7/22/24, 6:54 PM

Both the POST and OPTIONS don't include it

Original message was deleted

H

Hugo•7/22/24, 6:56 PM

OPTIONS is 200, then the POST is 403, challenged. While I have the cf_clearance cookie set in the browser + credentials on 'include'

Original message was deleted

H

Hugo•7/22/24, 7:04 PM

I'm probably missing something, but that's what I have, an 200 OPTIONS, a 403 POST, a cf_clearance that is not passed through

Original message was deleted

H

Hugo•7/22/24, 7:13 PM

I set a dynamic rule for that, otherwise it was blocked like this

Original message was deleted

H

Hugo•7/22/24, 7:24 PM

exactly!

Original message was deleted

H

Hugo•7/22/24, 7:24 PM

yep

H

Hugo•7/22/24, 7:25 PM

yeah so it should be the same domain

H

Hugo•7/22/24, 7:27 PM

Yep so the domain field of the cookie will be example.com, then with credential mode, the call to api.example.com will pass the cookie

Original message was deleted

H

Hugo•7/22/24, 7:40 PM

have you other folks in that situation? We develop a new feature deployed on something.pages.dev, but we have to call our backends at api.example.com. In the context of Turnstile for fetch.

Original message was deleted

H

Hugo•7/22/24, 8:40 PM

Nice idea !

K

ks•7/23/24, 1:40 PM

Hi guys, need some help here. I'm getting SSL error when my azure app service trying to call the https://challenges.cloudflare.com/turnstile/v0/siteverify

System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.

System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.

System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.

System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.

Any idea how we can fix it?

J

Jonny•7/25/24, 5:52 AM

Hello! mates

J

Jonny•7/25/24, 5:52 AM

I keep getting this error when verifying humanity.

J

Jonny•7/25/24, 5:52 AM

Could you help?

J

Jonny•7/25/24, 5:52 AM

8a89e23fef676889

J

Jonny•7/25/24, 5:52 AM

RayID

J

Jonny•7/25/24, 5:52 AM

Thanks

J

Jonny•7/25/24, 5:52 AM

It happened from 3 days ago

J

Jonny•7/25/24, 5:54 AM

8a89e57029b429d2 as well

A

abocsan•7/25/24, 7:01 AM

Hello! I am encountering an issue on a production environment regarding the console opening a debugger statement for a few seconds when turnstile is visible and have the console opened. This can be reproduced also here: https://dash.cloudflare.com/login is there any way to disable that ?

S

Sebastian•7/25/24, 7:06 AM

has there been any updates on turnstile adding an entry to browser history every time it refreshes

S

Sebastian•7/25/24, 7:07 AM

or maybe a workaround to make it not do that

Sslowlorisd Do you have any extension in your browser?

J

Jonny•7/25/24, 7:51 AM

a lot, I am a crypto user.

Y

YoshiJL•7/25/24, 7:15 PM

Has anyone had issues with Turnstile running

turnstile.ready

turnstile.ready

turnstile.ready

turnstile.ready twice (and rendering the Turnstile twice)?

Y

YoshiJL•7/26/24, 12:35 AM

yeah, same happened for us. We had to add a check for first run inside the callback of

turnstile.ready

turnstile.ready

turnstile.ready

turnstile.ready to fix this

R

Reed•7/26/24, 4:49 AM

I am having multiple of the turnstile appear on a wordpress form (made with Fluent Forms). Anyone else seen this issue?

M

mhanley•7/26/24, 1:04 PM

Same here! Yesterday we started getting double captcha even on our dev environments

K

kian•7/26/24, 3:42 PM

~~Does anyone have a minimal reproduction for the double rendering, i.e how you're including the script & the Turnstile code?~~ This is known and a fix will be going out.

Y

YoshiJL•7/26/24, 5:09 PM

@kian any updates regarding the fix?

SSebastian has there been any updates on turnstile adding an entry to browser history every...

S

Sebastian•7/27/24, 7:48 AM

.

SSebastian or maybe a workaround to make it not do that

S

Sebastian•7/27/24, 7:48 AM

.

Similar Threads

Similar Threads

Similar Threads