You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/content/docs/turnstile/concepts/ephemeral-id.mdx
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,7 +8,7 @@ sidebar:
8
8
9
9
Ephemeral IDs generate a unique short-lived ID that can link behavior to a specific client instead of an IP address without relying on setting any cookies or using similar client-side storage.
10
10
11
-
When the same visitor interacts with Turnstile widgets from different Cloudflare customers, they receive different Ephemeral IDs for each contact. In attacks where fraudsters attempt to disguise themselves using different IP addresses, Ephemeral IDs detect abuse patterns more accurately than determining whether the visitor is a human or a bot.
11
+
When the same visitor interacts with Turnstile widgets from different Cloudflare customers, they receive different Ephemeral IDs for each contact. In attacks where fraudsters attempt to disguise themselves using different IP addresses, Ephemeral IDs detect abuse patterns more accurately than determining whether the visitor is a human or a bot.
12
12
13
13
Ephemeral IDs are not unique and have a lifespan of up to a few days. They can be useful for identifying a bad actor in acute attacks such as sudden spikes in fake account creations or credential stuffing.
Copy file name to clipboardExpand all lines: src/content/docs/turnstile/concepts/hostname-management.mdx
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,13 +16,13 @@ Only Enterprise Bot Management and Enterprise Turnstile customers can have this
16
16
17
17
## Add a custom hostname
18
18
19
-
You can add a hostname to your Turnstile widget even if it is not on the Cloudflare network or registered as a zone. There are no prerequisites for using Turnstile.
19
+
You can add a hostname to your Turnstile widget even if it is not on the Cloudflare network or registered as a zone. There are no prerequisites for using Turnstile.
20
20
21
21
To add a custom hostname:
22
22
23
23
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/) and select your account.
24
24
2. Go to **Turnstile**.
25
-
3. On an existing widget, select **Settings**.
25
+
3. On an existing widget, select **Settings**.
26
26
4. Select **Add Hostnames** under Hostname Management.
27
27
5. Add a custom hostname or choose from an existing hostname.
28
28
6. Select **Add**.
@@ -42,7 +42,7 @@ When associating hostnames with a widget, follow these requirements:
42
42
- A port (for example, `443`)
43
43
- A path (for example, `/path`)
44
44
45
-
### Subdomain specification
45
+
### Subdomain specification
46
46
47
47
Specifying a subdomain is optional, but it can be used to further restrict the widget. For example, adding `www.example.com` as a hostname will allow widgets to work on:
Copy file name to clipboardExpand all lines: src/content/docs/turnstile/concepts/pre-clearance-support.mdx
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,22 +6,22 @@ sidebar:
6
6
7
7
---
8
8
9
-
Pre-clearance in Turnstile allows websites to streamline user experiences by using clearance cookies. These cookies enable visitors to bypass WAF challenges downstream, based on the security clearance level set by the customer. This can be particularly useful for trusted visitors, enhancing usability while maintaining security.
9
+
Pre-clearance in Turnstile allows websites to streamline user experiences by using clearance cookies. These cookies enable visitors to bypass WAF challenges downstream, based on the security clearance level set by the customer. This can be particularly useful for trusted visitors, enhancing usability while maintaining security.
10
10
11
11
You can integrate Cloudflare challenges by allowing Turnstile to issue a pre-clearance cookie. The pre-clearance level is set upon widget creation or widget modification using the Turnstile API's `clearance_level`. Possible values for the configuration are:
12
12
13
13
-`no_clearance`
14
14
-`jschallenge`
15
15
-`managed`
16
-
-`interactive`
16
+
-`interactive`
17
17
18
18
All widgets are set to `no_clearance` by default.
19
19
20
20
For Enterprise customers eligible to toggle off domain checks, Cloudflare recommends issuing pre-clearance cookies on widgets where at least one domain is specified.
21
21
22
22
:::note
23
23
24
-
Clearance cookies only support zones that are orange-clouded.
24
+
Clearance cookies only support zones that are orange-clouded.
25
25
:::
26
26
27
27
Refer to the [blog post](https://blog.cloudflare.com/integrating-turnstile-with-the-cloudflare-waf-to-challenge-fetch-requests) for more details on how pre-clearance works with WAF.
Copy file name to clipboardExpand all lines: src/content/docs/turnstile/concepts/widget.mdx
+7-7Lines changed: 7 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,9 +12,9 @@ Every instance of Turnstile belongs to a Turnstile widget. It is configured on a
12
12
13
13
The 3 modes for Turnstile are **Managed**, **Non-Interactive**, and **Invisible**.
14
14
15
-
Refer to [appearance modes](/turnstile/get-started/client-side-rendering/#appearance-modes) to configure whether to have the widget be always visible or visible only when interaction is required.
15
+
Refer to [appearance modes](/turnstile/get-started/client-side-rendering/#appearance-modes) to configure whether to have the widget be always visible or visible only when interaction is required.
16
16
17
-
Widgets can be implemented in normal, flexible, or compact sizes.
17
+
Widgets can be implemented in normal, flexible, or compact sizes.
18
18
19
19
<Renderfile="widget-size" />
20
20
@@ -24,9 +24,9 @@ Refer to [widget sizes](/turnstile/get-started/client-side-rendering/#widget-siz
24
24
Customers with Enterprise Bot Management and Enterprise Turnstile have the ability to remove the Cloudflare branding and customize the Turnstile widget.
25
25
:::
26
26
27
-
## Availability
27
+
## Availability
28
28
29
-
Free users are limited to 10 widgets per account.
29
+
Free users are limited to 10 widgets per account.
30
30
31
31
Customers with Enterprise Bot Management and Enterprise Turnstile can have this limit increased. Contact your account team to increase your widget limit.
32
32
@@ -50,7 +50,7 @@ This mode is fully managed by Cloudflare. It automatically chooses the appropria
50
50
51
51
### Compact mode
52
52
53
-
You can configure the Turnstile widget in compact mode, which functions in the same way as a Managed widget.
53
+
You can configure the Turnstile widget in compact mode, which functions in the same way as a Managed widget.
54
54
55
55
#### Light mode
56
56
@@ -84,15 +84,15 @@ This mode is similar to non-interactive mode where visitors will never interact
When an unknown error occurs during the challenge, visitors will encounter this widget state. Visitors can refresh and retry the challenge. If the error persists, they can submit a feedback form by selecting **Send feedback** on the widget.
87
+
When an unknown error occurs during the challenge, visitors will encounter this widget state. Visitors can refresh and retry the challenge. If the error persists, they can submit a feedback form by selecting **Send feedback** on the widget.
88
88
89
89
Refer to [Feedback reports](/turnstile/troubleshooting/feedback-reports) for more information.
Copy file name to clipboardExpand all lines: src/content/docs/turnstile/extensions/google-firebase.mdx
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,15 +11,15 @@ Turnstile is [available as an extension](https://extensions.dev/extensions/cloud
11
11
12
12
Google Firebase is a comprehensive app development platform that provides a variety of tools and services to help developers build, improve, and grow their mobile and web applications.
13
13
14
-
Firebase App Check helps protect Firebase resources like Cloud Firestore, Realtime Database, Cloud Storage, and Functions from abuse, such as automated fraud attacks and denial of service (DoS) attacks, by ensuring that incoming requests are from legitimate visitors and trusted sources.
14
+
Firebase App Check helps protect Firebase resources like Cloud Firestore, Realtime Database, Cloud Storage, and Functions from abuse, such as automated fraud attacks and denial of service (DoS) attacks, by ensuring that incoming requests are from legitimate visitors and trusted sources.
15
15
16
16
## Set up a Google Firebase project
17
17
18
18
1. Create a Firebase project by going to the [Firebase Console](https://console.firebase.google.com/).
19
19
2. Select **Add Project** and follow the prompts to create a new project.
20
20
3. Add an app to your project by selecting your project.
21
21
4. In the project overview, select **Add App** and choose the platform: **Web**.
22
-
5.[Register your app](https://firebase.google.com/docs/web/setup?hl=en&authuser=0#register-app) and follow the guide to get your Firebase configuration.
22
+
5.[Register your app](https://firebase.google.com/docs/web/setup?hl=en&authuser=0#register-app) and follow the guide to get your Firebase configuration.
23
23
24
24
:::note
25
25
@@ -28,7 +28,7 @@ It is important to register your web app first to connect it with Turnstile late
28
28
29
29
## Set up Cloudflare Turnstile
30
30
31
-
1. Create a Cloudflare Turnstile site by going to the [Cloudflare Turnstile dashboard](https://dash.cloudflare.com/?to=/:account/turnstile).
31
+
1. Create a Cloudflare Turnstile site by going to the [Cloudflare Turnstile dashboard](https://dash.cloudflare.com/?to=/:account/turnstile).
32
32
2. Create a new widget and get the [sitekey and secret key](/turnstile/get-started/#get-a-sitekey-and-secret-key).
33
33
- The domain you configure with the Turnstile widget should be the domain of your web app.
34
34
- The [widget mode](/turnstile/concepts/widget/) must be **Invisible**.
@@ -43,7 +43,7 @@ It is important to register your web app first to connect it with Turnstile late
43
43
4. Enter the secret key from Cloudflare Turnstile and your Firebase App ID.
44
44
5. Select **Install extension**.
45
45
46
-
### Grant access to the Cloudflare extension
46
+
### Grant access to the Cloudflare extension
47
47
48
48
1. Grant access to the Cloudflare extension under the IAM section of your project by selecting **Grant Access** under **View by Principals**.
49
49
2. Select `ext-cloudflare-turnstile` from the dropdown menu.
### Verify the App Check token in your web application
91
+
### Verify the App Check token in your web application
92
92
93
-
To verify the App Check token in your web application, refer to Firebase's [Token Verification guide](https://firebase.google.com/docs/app-check/custom-resource-backend?hl=en#verification).
93
+
To verify the App Check token in your web application, refer to Firebase's [Token Verification guide](https://firebase.google.com/docs/app-check/custom-resource-backend?hl=en#verification).
Copy file name to clipboardExpand all lines: src/content/docs/turnstile/get-started/mobile-implementation.mdx
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,13 +13,13 @@ Any modifications to the environment, such as the User Agent, [Content Security
13
13
14
14
## WebView configurations
15
15
16
-
Turnstile requires specific WebView settings to function properly. For Android implementations, refer to [`setJavaScriptEnabled`](https://developer.android.com/reference/android/webkit/WebSettings#setJavaScriptEnabled(boolean)) to tell the WebView to enable JavaScript execution and [`setDomStorageEnabled`](https://developer.android.com/reference/android/webkit/WebSettings#setDomStorageEnabled(boolean)) to enable the DOM storage API.
16
+
Turnstile requires specific WebView settings to function properly. For Android implementations, refer to [`setJavaScriptEnabled`](https://developer.android.com/reference/android/webkit/WebSettings#setJavaScriptEnabled(boolean)) to tell the WebView to enable JavaScript execution and [`setDomStorageEnabled`](https://developer.android.com/reference/android/webkit/WebSettings#setDomStorageEnabled(boolean)) to enable the DOM storage API.
17
17
18
18
These settings ensure that the mobile WebView can properly load and execute the Turnstile challenge. If these configurations are missing, Turnstile may malfunction.
19
19
20
20
## Update allowed origins
21
21
22
-
In addition to ensuring proper WebView settings, if you have allowed origins configured, it is essential to update the list to include:
22
+
In addition to ensuring proper WebView settings, if you have allowed origins configured, it is essential to update the list to include:
Only [React Native](https://github.com/react-native-webview/react-native-webview/blob/master/docs/Reference.md#originwhitelist) contains the allowed origins above by default.
33
33
:::
34
34
35
-
Without this, Turnstile challenges might fail to load. WebView should also be configured to allow insecure connections (`http` and `https`).
35
+
Without this, Turnstile challenges might fail to load. WebView should also be configured to allow insecure connections (`http` and `https`).
36
36
37
37
## Maintain a consistent user agent
38
38
39
-
When implementing Turnstile with WebViews, the user agent must stay consistent as changing the user agent will cause the challenges to fail.
39
+
When implementing Turnstile with WebViews, the user agent must stay consistent as changing the user agent will cause the challenges to fail.
Copy file name to clipboardExpand all lines: src/content/docs/turnstile/get-started/pre-clearance.mdx
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,7 +13,7 @@ import { Render } from "~/components"
13
13
14
14
To enable pre-clearance, you must ensure that the hostname of the Turnstile widget matches the zone with the WAF rules. During the Turnstile configuration setup in the Cloudflare dashboard, you can see the registered zones. Select the appropriate hostname from this list.
15
15
16
-
The prerequisite is crucial for pre-clearance to function properly. If set up correctly, visitors who successfully solve Turnstile will receive a cookie with the security clearance level set by the customer. When encountering a WAF challenge on the same zone, they will bypass additional challenges for the configured clearance level and below.
16
+
The prerequisite is crucial for pre-clearance to function properly. If set up correctly, visitors who successfully solve Turnstile will receive a cookie with the security clearance level set by the customer. When encountering a WAF challenge on the same zone, they will bypass additional challenges for the configured clearance level and below.
17
17
18
18
For more details on managing hostnames, refer to the [Hostname Management documentation](/turnstile/concepts/hostname-management/).
0 commit comments