Anyone else experiencing a 500 http response code when fetching “https://challenges.cloudflare.com/c

K

kian•10/23/24, 3:44 PM

How often does it occur?

S

We’re only in testing right now but our QA has been experiencing it daily. Started seeing it Monday. It was happening very frequently then so we thought it was because of the scheduled maintenance. Seems to have improved a bit since but is still happening infrequently. Also seems to be happening more on specific machines on different networks.

Sstack_underflow We’re only in testing right now but our QA has been experiencing it daily. Start...

K

kian•10/23/24, 4:20 PM

Thanks! Are you able to share your sitekey? Feel free to DM me it (but fwiw they aren't sensitive values).

S

stack_underflowOP•10/23/24, 6:34 PM

0x4AAAAAAAhWUK4Q-E6T0RlF

S

stack_underflowOP•10/23/24, 6:38 PM

Also seeing this in the console

Turnstile Widget seem to have hung: qxvom
[Cloudflare Turnstile] Error: 300030.

O

Olof•10/24/24, 2:27 PM

Hi I'm trying to verify the token on the backend. Using Net Core. I get a StatusCode OK even though I pass in random strings as token and secret key. I cant understand why.

var content = new FormUrlEncodedContent(new Dictionary<string, string>
            {
                {"secret", "Wrong_secretKey"},
                {"response", "Random_string_as_token" },
                {"remoteip", remoteIpAddress.ToString() }
            });
            var response = await _httpClient.PostAsync("https://challenges.cloudflare.com/turnstile/v0/siteverify", content);
            if(response.IsSuccessStatusCode)
            {
                var result = response.ToJson(); //response.Content.ReadFromJsonAsync<CaptchaResponse>();
                return result;
            }
            return $"Error verifying Captcha: {response.StatusCode}";

var content = new FormUrlEncodedContent(new Dictionary<string, string>
            {
                {"secret", "Wrong_secretKey"},
                {"response", "Random_string_as_token" },
                {"remoteip", remoteIpAddress.ToString() }
            });
            var response = await _httpClient.PostAsync("https://challenges.cloudflare.com/turnstile/v0/siteverify", content);
            if(response.IsSuccessStatusCode)
            {
                var result = response.ToJson(); //response.Content.ReadFromJsonAsync<CaptchaResponse>();
                return result;
            }
            return $"Error verifying Captcha: {response.StatusCode}";

var content = new FormUrlEncodedContent(new Dictionary<string, string>
            {
                {"secret", "Wrong_secretKey"},
                {"response", "Random_string_as_token" },
                {"remoteip", remoteIpAddress.ToString() }
            });
            var response = await _httpClient.PostAsync("https://challenges.cloudflare.com/turnstile/v0/siteverify", content);
            if(response.IsSuccessStatusCode)
            {
                var result = response.ToJson(); //response.Content.ReadFromJsonAsync<CaptchaResponse>();
                return result;
            }
            return $"Error verifying Captcha: {response.StatusCode}";

var content = new FormUrlEncodedContent(new Dictionary<string, string>
            {
                {"secret", "Wrong_secretKey"},
                {"response", "Random_string_as_token" },
                {"remoteip", remoteIpAddress.ToString() }
            });
            var response = await _httpClient.PostAsync("https://challenges.cloudflare.com/turnstile/v0/siteverify", content);
            if(response.IsSuccessStatusCode)
            {
                var result = response.ToJson(); //response.Content.ReadFromJsonAsync<CaptchaResponse>();
                return result;
            }
            return $"Error verifying Captcha: {response.StatusCode}";

O

Olof•10/24/24, 2:27 PM

This is my response (from result.json)

Version    "1.1"
Content    Object { Headers: […] }
Headers    [ {…}, {…} ]
0    Object { Key: "Content-Type", Value: […] }
Key    "Content-Type"
Value    [ "application/json" ]
1    Object { Key: "Content-Length", Value: […] }
Key    "Content-Length"
Value    [ "70" ]
StatusCode    "ok"
ReasonPhrase    "OK"
Headers    [ {…}, {…}, {…}, {…}, {…} ]
0    Object { Key: "Date", Value: […] }
Key    "Date"
Value    [ "Thu, 24 Oct 2024 14:21:25 GMT" ]
0    "Thu, 24 Oct 2024 14:21:25 GMT"
1    Object { Key: "Connection", Value: […] }
Key    "Connection"
Value    [ "keep-alive" ]
0    "keep-alive"
2    Object { Key: "Server", Value: […] }
Key    "Server"
Value    [ "cloudflare" ]
3    Object { Key: "CF-RAY", Value: […] }
Key    "CF-RAY"
Value    [ "8d7a9cf80b6209b0-ARN" ]
0    "8d7a9cf80b6209b0-ARN"
4    Object { Key: "Alt-Svc", Value: […] }
Key    "Alt-Svc"
Value    [ 'h3=":443"' ]
TrailingHeaders    []
RequestMessage    Object { Version: "1.1", VersionPolicy: "requestVersionOrLower", RequestUri: "https://challenges.cloudflare.com/turnstile/v0/siteverify", … }
Version    "1.1"
VersionPolicy    "requestVersionOrLower"
Content    Object { Headers: […] }
Method    Object { Method: "POST" }
RequestUri    "https://challenges.cloudflare.com/turnstile/v0/siteverify"
Headers    [ {…} ]
0    Object { Key: "traceparent", Value: […] }
Key    "traceparent"
Value    [ "00-3fc6a3746c4609166de3f4e37f6e82c3-6eb800d5f07796be-XX" ]
0    "00-3fc6a3746c4609166de3f4e37f6e82c3-6eb800d5f07796be-00"
Properties    Object { }
Options    Object { }
IsSuccessStatusCode    true

Version    "1.1"
Content    Object { Headers: […] }
Headers    [ {…}, {…} ]
0    Object { Key: "Content-Type", Value: […] }
Key    "Content-Type"
Value    [ "application/json" ]
1    Object { Key: "Content-Length", Value: […] }
Key    "Content-Length"
Value    [ "70" ]
StatusCode    "ok"
ReasonPhrase    "OK"
Headers    [ {…}, {…}, {…}, {…}, {…} ]
0    Object { Key: "Date", Value: […] }
Key    "Date"
Value    [ "Thu, 24 Oct 2024 14:21:25 GMT" ]
0    "Thu, 24 Oct 2024 14:21:25 GMT"
1    Object { Key: "Connection", Value: […] }
Key    "Connection"
Value    [ "keep-alive" ]
0    "keep-alive"
2    Object { Key: "Server", Value: […] }
Key    "Server"
Value    [ "cloudflare" ]
3    Object { Key: "CF-RAY", Value: […] }
Key    "CF-RAY"
Value    [ "8d7a9cf80b6209b0-ARN" ]
0    "8d7a9cf80b6209b0-ARN"
4    Object { Key: "Alt-Svc", Value: […] }
Key    "Alt-Svc"
Value    [ 'h3=":443"' ]
TrailingHeaders    []
RequestMessage    Object { Version: "1.1", VersionPolicy: "requestVersionOrLower", RequestUri: "https://challenges.cloudflare.com/turnstile/v0/siteverify", … }
Version    "1.1"
VersionPolicy    "requestVersionOrLower"
Content    Object { Headers: […] }
Method    Object { Method: "POST" }
RequestUri    "https://challenges.cloudflare.com/turnstile/v0/siteverify"
Headers    [ {…} ]
0    Object { Key: "traceparent", Value: […] }
Key    "traceparent"
Value    [ "00-3fc6a3746c4609166de3f4e37f6e82c3-6eb800d5f07796be-XX" ]
0    "00-3fc6a3746c4609166de3f4e37f6e82c3-6eb800d5f07796be-00"
Properties    Object { }
Options    Object { }
IsSuccessStatusCode    true

Version    "1.1"
Content    Object { Headers: […] }
Headers    [ {…}, {…} ]
0    Object { Key: "Content-Type", Value: […] }
Key    "Content-Type"
Value    [ "application/json" ]
1    Object { Key: "Content-Length", Value: […] }
Key    "Content-Length"
Value    [ "70" ]
StatusCode    "ok"
ReasonPhrase    "OK"
Headers    [ {…}, {…}, {…}, {…}, {…} ]
0    Object { Key: "Date", Value: […] }
Key    "Date"
Value    [ "Thu, 24 Oct 2024 14:21:25 GMT" ]
0    "Thu, 24 Oct 2024 14:21:25 GMT"
1    Object { Key: "Connection", Value: […] }
Key    "Connection"
Value    [ "keep-alive" ]
0    "keep-alive"
2    Object { Key: "Server", Value: […] }
Key    "Server"
Value    [ "cloudflare" ]
3    Object { Key: "CF-RAY", Value: […] }
Key    "CF-RAY"
Value    [ "8d7a9cf80b6209b0-ARN" ]
0    "8d7a9cf80b6209b0-ARN"
4    Object { Key: "Alt-Svc", Value: […] }
Key    "Alt-Svc"
Value    [ 'h3=":443"' ]
TrailingHeaders    []
RequestMessage    Object { Version: "1.1", VersionPolicy: "requestVersionOrLower", RequestUri: "https://challenges.cloudflare.com/turnstile/v0/siteverify", … }
Version    "1.1"
VersionPolicy    "requestVersionOrLower"
Content    Object { Headers: […] }
Method    Object { Method: "POST" }
RequestUri    "https://challenges.cloudflare.com/turnstile/v0/siteverify"
Headers    [ {…} ]
0    Object { Key: "traceparent", Value: […] }
Key    "traceparent"
Value    [ "00-3fc6a3746c4609166de3f4e37f6e82c3-6eb800d5f07796be-XX" ]
0    "00-3fc6a3746c4609166de3f4e37f6e82c3-6eb800d5f07796be-00"
Properties    Object { }
Options    Object { }
IsSuccessStatusCode    true

Version    "1.1"
Content    Object { Headers: […] }
Headers    [ {…}, {…} ]
0    Object { Key: "Content-Type", Value: […] }
Key    "Content-Type"
Value    [ "application/json" ]
1    Object { Key: "Content-Length", Value: […] }
Key    "Content-Length"
Value    [ "70" ]
StatusCode    "ok"
ReasonPhrase    "OK"
Headers    [ {…}, {…}, {…}, {…}, {…} ]
0    Object { Key: "Date", Value: […] }
Key    "Date"
Value    [ "Thu, 24 Oct 2024 14:21:25 GMT" ]
0    "Thu, 24 Oct 2024 14:21:25 GMT"
1    Object { Key: "Connection", Value: […] }
Key    "Connection"
Value    [ "keep-alive" ]
0    "keep-alive"
2    Object { Key: "Server", Value: […] }
Key    "Server"
Value    [ "cloudflare" ]
3    Object { Key: "CF-RAY", Value: […] }
Key    "CF-RAY"
Value    [ "8d7a9cf80b6209b0-ARN" ]
0    "8d7a9cf80b6209b0-ARN"
4    Object { Key: "Alt-Svc", Value: […] }
Key    "Alt-Svc"
Value    [ 'h3=":443"' ]
TrailingHeaders    []
RequestMessage    Object { Version: "1.1", VersionPolicy: "requestVersionOrLower", RequestUri: "https://challenges.cloudflare.com/turnstile/v0/siteverify", … }
Version    "1.1"
VersionPolicy    "requestVersionOrLower"
Content    Object { Headers: […] }
Method    Object { Method: "POST" }
RequestUri    "https://challenges.cloudflare.com/turnstile/v0/siteverify"
Headers    [ {…} ]
0    Object { Key: "traceparent", Value: […] }
Key    "traceparent"
Value    [ "00-3fc6a3746c4609166de3f4e37f6e82c3-6eb800d5f07796be-XX" ]
0    "00-3fc6a3746c4609166de3f4e37f6e82c3-6eb800d5f07796be-00"
Properties    Object { }
Options    Object { }
IsSuccessStatusCode    true

M

manjerico•10/24/24, 2:59 PM

someone can correct me if I'm wrong, but it seems like you're looking into the HTTP response success code to assess proper validation, instead of the

success

success

success

success property inside the response data

Mmanjerico someone can correct me if I'm wrong, but it seems like you're looking into the H...

O

Olof•10/24/24, 3:22 PM

Thanks for the tip. I ended up using a package called BitArmory.Turnstile that seams to work.

J

Joe•10/24/24, 3:36 PM

in my code i'm looking for the success

(!$response['success'])

(!$response['success'])

(!$response['success'])

(!$response['success'])

Sstack_underflow Anyone else experiencing a 500 http response code when fetching “https://challen...

H

Hugo•10/25/24, 2:42 PM

We face a similar issue, causing the widget to stay in place after validation

Ddanwall Looking into my issue further, I seem to be getting a lot of 400020 errors which...

S

stack_underflowOP•10/29/24, 5:02 PM

For some reason they changed the invalid site key to this error. I had to dig through the code to find it.

R

REcpa123•11/4/24, 9:30 PM

I tired adding a new form to my site using Fluent Forms. I have had Turnstile on my site for a couple of years and never had any issues. On the new form when I hit submit I get an error to "please prove that you are human x" but no where to check a box. I'm not using WAF rules, just the api key. I ended up disabling the plugin.

Original message was deleted

R

REcpa123•11/13/24, 8:11 PM

https://www.loom.com/share/ee20a05aaf7c43f08c67269d2429ce02?sid=bc7bb9b8-11e6-4ae5-93ea-39d5f6d8486a

Loom

Video Message Troubleshooting

Hey there! In this video, I troubleshoot an issue with sending a message. I encounter a problem at 0 seconds and try to resolve it by putting something in at 14 seconds. Watch how I navigate through the process. No action requested from you, just a quick walkthrough!

R

REcpa123•11/13/24, 8:12 PM

You really just need to see the end of the video once I click submit.

S

space77along•11/14/24, 1:40 AM

I got my hands on Claude 3.5 Sonnet with computer use, and it seems surprising good at passing captchas.
I'm using https://github.com/showlab/computer_use_ootb to control a VM instead of https://github.com/anthropics/anthropic-quickstarts/tree/main/computer-use-demo in docker so maybe it performed better.

GitHub

GitHub - showlab/computer_use_ootb: An out-of-the-box (OOTB) versio...

An out-of-the-box (OOTB) version of Anthropic Claude Computer Use for Windows and macOS - showlab/computer_use_ootb

GitHub

anthropic-quickstarts/computer-use-demo at main · anthropics/anthro...

A collection of projects designed to help developers quickly get started with building deployable applications using the Anthropic API - anthropics/anthropic-quickstarts

D

DevsrealmGuy•11/14/24, 11:28 AM

Hi guys, anyone knows why I all of a sudden started getting the error:

invalid-input-response

invalid-input-response

invalid-input-response

invalid-input-response

D

DevsrealmGuy•11/14/24, 11:32 AM

Here is part of my implementation:

    // Helper function to make POST requests using fetch
    const postRequest = async (data:any) => {
        const response = await fetch(url, {
            method: 'POST',
            headers: {
                'Content-Type': 'application/json',
            },
            body: JSON.stringify(data),
        });

        return response.json();  // Parse and return JSON response
    };

// Generate an idempotency key for the request
const idempotencyKey = crypto.randomUUID();

const firstOutcome = await postRequest({
            secret: SECRET_KEY,
            response: token,
            remoteip: ip,
            idempotency_key: idempotencyKey,
        });

    // Helper function to make POST requests using fetch
    const postRequest = async (data:any) => {
        const response = await fetch(url, {
            method: 'POST',
            headers: {
                'Content-Type': 'application/json',
            },
            body: JSON.stringify(data),
        });

        return response.json();  // Parse and return JSON response
    };

// Generate an idempotency key for the request
const idempotencyKey = crypto.randomUUID();

const firstOutcome = await postRequest({
            secret: SECRET_KEY,
            response: token,
            remoteip: ip,
            idempotency_key: idempotencyKey,
        });

    // Helper function to make POST requests using fetch
    const postRequest = async (data:any) => {
        const response = await fetch(url, {
            method: 'POST',
            headers: {
                'Content-Type': 'application/json',
            },
            body: JSON.stringify(data),
        });

        return response.json();  // Parse and return JSON response
    };

// Generate an idempotency key for the request
const idempotencyKey = crypto.randomUUID();

const firstOutcome = await postRequest({
            secret: SECRET_KEY,
            response: token,
            remoteip: ip,
            idempotency_key: idempotencyKey,
        });

    // Helper function to make POST requests using fetch
    const postRequest = async (data:any) => {
        const response = await fetch(url, {
            method: 'POST',
            headers: {
                'Content-Type': 'application/json',
            },
            body: JSON.stringify(data),
        });

        return response.json();  // Parse and return JSON response
    };

// Generate an idempotency key for the request
const idempotencyKey = crypto.randomUUID();

const firstOutcome = await postRequest({
            secret: SECRET_KEY,
            response: token,
            remoteip: ip,
            idempotency_key: idempotencyKey,
        });

D

DevsrealmGuy•11/14/24, 11:54 AM

This has been working since October and yesterday all of a sudden, I had the error

D

DevsrealmGuy•11/14/24, 12:15 PM

No, you can check here: ] Redacted] it passes the captcha, however, if you inspect with devtool, it returns the error

A

ake•11/14/24, 12:39 PM

Have same problem, validation produces invalid-input-response even on "always pass" test key. It accepts everything but widget response

D

DevsrealmGuy•11/14/24, 12:55 PM

In my case, this has been working for months (since October), the issue started appearing yesterday all of a sudden, didn't make no change

Sslowlorisd Are you using the correct secret key when calling siteverify? Test secret keys c...

D

DevsrealmGuy•11/14/24, 1:03 PM

Between, siteVerify should be called with the SecretKey and not the SiteKey, asking because you mentioned SiteKey here

D

DevsrealmGuy•11/14/24, 1:51 PM

Yeah, I intentionally added that just now to nail the issue, apparently, the last person that deployed it didn't run the build function that would swap the dev env with the one in prod.

D

DevsrealmGuy•11/14/24, 1:54 PM

Though, I still can't confirm this worked yet as I am waiting for my new changes to be deployed

P

p97o2s•11/15/24, 8:09 PM

Hey CF team, Turnstile seems to be impacting the Google OAuth pop-up here.
The page refreshes once users click on the "Sign in with Google" button. It works without problems when running Firebase AppCheck with Recaptcha.

I get these errors:
• “[Cloudflare Turnstile] Nothing to reset found for provided container.”
• “Firebase: Error (auth/popup-blocked).”

D

Dave@Ammo•11/20/24, 7:36 PM

What is the next step to troubleshoot users encountering Uncaught TurnstileError: [Cloudflare Turnstile] Error: 600010. Tried private mode, cleared cache and cookies and disabled Extensions

X

Xabi•11/21/24, 2:14 PM

Can you modify the Passing Threshold?

X

Xabi•11/21/24, 2:14 PM

Like you can on hcaptcha

X

Xabi•11/22/24, 6:12 PM

Sad

X

Xabi•11/22/24, 6:12 PM

Makes me prefer hCaptcha over turnstile

S

space77along•11/23/24, 3:16 AM

turnstile pass rate drop significantly when the tab is in background, we found out a hard way today, one of our download page will open in a new tab for a brief second and client is having hard time for ~5 hours, I think we broke SLA.

T

Two•11/23/24, 7:24 PM

for turnstile: does the invisible challenge become visible and display an interactive challenge... or is the invisible challenge solely just "visible" and "invisible"?

XXabi Makes me prefer hCaptcha over turnstile

Y

You•12/6/24, 7:19 PM

at least it's not that ROBLOX CAPTCHA ("Impossible" Orbit CAPTCHA) and you have to make this for 10 times in a row if there's connection interference it can take over hundred times in a row

Original message was deleted

Y

You•12/6/24, 7:23 PM

Cloudflare Turnstile uses recent activities to detect human/robot activity, and humans can pass this with one click (even with a keyboard mouse for people who do not have a mouse).

~

~ भगवान्™ 💤•12/9/24, 2:33 PM

how to add this site.

P

penny•12/10/24, 2:04 PM

Hello everyone, I've been using reCAPTCHA v2 for the past year or so, but recently I wanted to checkout cloudflare's turnstile... after reading a bit I found out that cloudflare's turnstile is not very good. but I feared that this mught be fake news, so I want to ask you... how good is turnstile against bots (more specifically on mobile apps)

B

Brianm•12/11/24, 12:08 AM

I'm getting an

invalid-input-secret

invalid-input-secret

invalid-input-secret

invalid-input-secret when attempting to validate a token with the

1x0000000000000000000000000000000AA

1x0000000000000000000000000000000AA

1x0000000000000000000000000000000AA

1x0000000000000000000000000000000AA test secret and a token from the client. I've broken it down to be able to reproduce with a curl command:

curl -X POST https://challenges.cloudflare.com/turnstile/v0/siteverify --data '{"secret":"1x0000000000000000000000000000000AA","response":"asdf"}' -H "Content-Type: application/json" -i
# succeeds

curl -X POST https://challenges.cloudflare.com/turnstile/v0/siteverify --data '{"secret":"1x0000000000000000000000000000000AA","response":"my-token-here"}' -H "Content-Type: application/json" -i
# fails with {"success":false,"error-codes":["invalid-input-secret"],"messages":[]}

curl -X POST https://challenges.cloudflare.com/turnstile/v0/siteverify --data '{"secret":"1x0000000000000000000000000000000AA","response":"asdf"}' -H "Content-Type: application/json" -i
# succeeds

curl -X POST https://challenges.cloudflare.com/turnstile/v0/siteverify --data '{"secret":"1x0000000000000000000000000000000AA","response":"my-token-here"}' -H "Content-Type: application/json" -i
# fails with {"success":false,"error-codes":["invalid-input-secret"],"messages":[]}

curl -X POST https://challenges.cloudflare.com/turnstile/v0/siteverify --data '{"secret":"1x0000000000000000000000000000000AA","response":"asdf"}' -H "Content-Type: application/json" -i
# succeeds

curl -X POST https://challenges.cloudflare.com/turnstile/v0/siteverify --data '{"secret":"1x0000000000000000000000000000000AA","response":"my-token-here"}' -H "Content-Type: application/json" -i
# fails with {"success":false,"error-codes":["invalid-input-secret"],"messages":[]}

curl -X POST https://challenges.cloudflare.com/turnstile/v0/siteverify --data '{"secret":"1x0000000000000000000000000000000AA","response":"asdf"}' -H "Content-Type: application/json" -i
# succeeds

curl -X POST https://challenges.cloudflare.com/turnstile/v0/siteverify --data '{"secret":"1x0000000000000000000000000000000AA","response":"my-token-here"}' -H "Content-Type: application/json" -i
# fails with {"success":false,"error-codes":["invalid-input-secret"],"messages":[]}

where my-token-here is replaced with the actual token, which I got from the turnstile client component. It's expired at the very least, and could be invalid in other ways – but why am I getting

invalid-input-secret

invalid-input-secret

invalid-input-secret

invalid-input-secret error message, when that's definitely not the problem, especially when using the test key that should make the token always pass?

I can share the actual token too if it's helpful; I've omitted it to keep things readable.