Seems turnstile randomly call history.pushState() now? We integrated passkey support and stealing in

Seems turnstile randomly call history.pushState() now?
We integrated passkey support and stealing input focus upon turnstile loaded is a bit of a headache.

space77alongOP•9/8/24, 3:58 PM

TBH turnstile is definitely not as noob friendly as recaptcha, the duplicated widget issue is complex enough for an entry level frontend dev interview.

SSebastian has there been any updates on turnstile adding an entry to browser history every...

Sebastian•9/9/24, 12:01 AM

any update on this?

Sebastian•9/9/24, 12:01 AM

its been months

Sspace77along Seems turnstile randomly call history.pushState() now? We integrated passkey sup...

Sebastian•9/9/24, 12:01 AM

think you might be experiencing the same issue i've been trying to ask about

Sebastian•9/9/24, 12:03 AM

https://community.cloudflare.com/t/turnstile-reset-mangles-browser-history/646797

space77alongOP•9/9/24, 12:14 AM

Glad I'm not along, this is not too bothering until some user do try to take advantage of their browser history, we'll be switching back to recaptcha for now I guess.

FTP•9/12/24, 12:00 PM

I didn't even realize it did that

FTP•9/12/24, 12:01 PM

That's dreadful

FTP•9/12/24, 12:40 PM

I can't even narrow down how it's adding breadcrumbs

IIsaac McFadyen For example, when the duplicate rendering issue was raised here (it was due to T...

nixrock•9/13/24, 1:48 PM

This is not true, I still have the widget loading twice issue and I'm not loading the script twice as you claim. I had reported the issue here along with URL.

Sslowlorisd Thanks for the reports, we've identified the browser history issue and will rele...

Stingo•9/13/24, 8:47 PM

also i noticed that when devtools are open turnstile tend to fail , is there any relevancy ?

Kenton•9/13/24, 11:47 PM

Hey y'all.. any movement on Web Component support for Turnstile?

SStingo also i noticed that when devtools are open turnstile tend to fail , is there any...

FTP•9/15/24, 1:53 AM

It's an issue with them leaving debug breakpoints on, I'm guessing. Hopefully they'll fix that in the next patch, too.

FFTP It's an issue with them leaving debug breakpoints on, I'm guessing. Hopefully th...

Stingo•9/16/24, 5:24 PM

hopefully

Original message was deleted

Stingo•9/16/24, 5:24 PM

not really , it would be really bad DX if you get fail on devtools open

Original message was deleted

Stingo•9/16/24, 5:29 PM

i can think of 1000 scenarios , for example me as a dev i want to check what my form is submitting and what the server is returning to catch errors

Stingo•9/16/24, 5:30 PM

it would really suck if i have to close devtools , solve turnstile and open again and doing that like 20 times

Original message was deleted

Stingo•9/17/24, 1:40 PM

No one's on dev env 100% of the time

Original message was deleted

Stingo•9/17/24, 1:41 PM

Good luck closing and reopening the devtool on each request, all I'm saying it's a necessary tool , there are tons of different way to detect bots, devtools is not of it

Original message was deleted

Stingo•9/17/24, 1:55 PM

You have to check what you are sending to server , that requires a solve on each req , which is inefficient

Stingo•9/17/24, 1:56 PM

TLDR , devtools != Bot

Sslowlorisd To be clear, Turnstile doesn't flag a user as a bot purely based on whether dev ...

Stingo•9/17/24, 11:13 PM

fair enough , i think as FTP said its the debug breakpoints whats causing the issue , also i had a weird bug with turnstile that i couldnt reproduce , basically just load and unloading itself by itself like error! => verifying and just loops like that forever until page is refreshed

Potako•9/18/24, 4:09 PM

Hi - how do we make contact to follow up for further diagnostics on QR codes/ray IDs once obtained? I've got a group of users who are reporting that Turnstile prompts are failing them with "Error - Refresh" without a specific error code, all of whom are using iPad devices and iOS Safari. Other users seem unaffected.

Erisa•9/18/24, 4:20 PM

post the ray ids here or send them to support

kian•9/19/24, 12:17 AM

That’s less than 2 requests a second, there are no rate limits you’re going to hit.

Original message was deleted

kian•9/19/24, 3:16 PM

The old beta behaviour was free usage is 1 million siteverify calls per month, the GA (now) behaviour is unlimited calls ~> https://www.cloudflare.com/en-gb/products/turnstile/#Page-Pricing-AS

Original message was deleted

kian•9/19/24, 3:17 PM

There's a flexibleflexible size: https://developers.cloudflare.com/turnstile/get-started/client-side-rendering/#widget-size

stack_underflow•9/20/24, 7:22 PM

Is there anyway to test an interactive challenge that fails?

ilonks•9/20/24, 8:15 PM

what should I be setting my domain to when developing on a local app simulator (webview on app)? I tried localhost, 127.0.0.1, my staging api url, but I'm still getting a Invalid domainInvalid domain error

I also have the whitelist set to:

originWhitelist={['http://', 'https://', 'challenges.cloudflare.com', 'about:blank', 'about:srcdoc']}

originWhitelist={['http://', 'https://', 'challenges.cloudflare.com', 'about:blank', 'about:srcdoc']}

Yomisana•9/22/24, 3:28 PM

hi there how I can let turnstile when loaded and user stay page too long need click checkbox like google recaptcha?

ShaunJH•9/23/24, 11:29 AM

Can anyone tell me if Cloudflare has a Privacy Policy for Turnstile? I need to know what specific data is procesed by Turnstile when it verifies a user through CAPTCHA, where it is stored and how long it is stored for, for my own website privacy policy.

ShaunJH•9/23/24, 12:32 PM

Thanks for this @Leo . However, it does only describe Cloudflare's generic privacy policy, not specfically Turnstile and does not describe what specific data is procesed by Turnstile or where it is stored and how long it is stored for,

Victor•9/23/24, 6:23 PM

It says ephemeral_idephemeral_id are short lived, but does anyone know the actual duration? Is it the same 300300 seconds that a token is valid for?

Original message was deleted

ilonks•9/23/24, 8:28 PM

what do you mean by widget settings? like the cloudflare turnstile dashboard where you manage your widget? I do have the following domains added (could not add about:blankabout:blank or about:srcdocabout:srcdoc, the UI doesn't allow me to)

localhost, 127.0.0.1, challenges.cloudflare.com, staging.<url>.com

localhost, 127.0.0.1, challenges.cloudflare.com, staging.<url>.com

but I'm still unable to develop on my local app simulator and get an Invalid domainInvalid domain error

Original message was deleted

Perfect•9/24/24, 8:37 PM

I have run into the same issue - its not responsive

Perfect•9/24/24, 8:38 PM

Also noticed this bug today with the background overlay - could this be an issue on my end?

Perfect•9/24/24, 8:39 PM

The overlay does not go away if you click cancel - only if you click on the overlay or the x (to close)

ilonks•9/25/24, 3:34 PM

Can someone help me with this?
https://discord.com/channels/595317990191398933/1025131875397812224/1287891933007581215

tl;dr The turnstile widget is giving an Invalid domain error on webview in react native app, but works on react website. I've set the domain on the widget settings (and those settings work for me on my react website), and set originWhitelist for the WebView. If I also need to add about:blankabout:blank and about:srcdocabout:srcdoc in the widget settings, I can't actually do that because the UI doesn't allow me to.

Perfect•9/25/24, 4:28 PM

After each form submission, should we reset turnstile?

Perfect•9/25/24, 4:28 PM

Ok cool, thanks

Original message was deleted

Perfect•9/25/24, 4:29 PM

So let’s say the form submission fails because username is already taken (or something like that)

Perfect•9/25/24, 4:30 PM

Still good for turnstile to reset each time the user tries a new username, etc?

Perfect•9/25/24, 4:30 PM

Well I know you can use an idempotency key

Perfect•9/25/24, 4:31 PM

But not sure when it’s correct to do so

Perfect•9/25/24, 4:34 PM

Roger that

Perfect•9/25/24, 6:13 PM

So like this?

Original message was deleted

Perfect•9/25/24, 6:16 PM

Ah good idea, I will disable until they verify they are human

Seems turnstile randomly call history.pushState() now? We integrated passkey support and stealing in

Similar Threads

Similar Threads

Similar Threads