Skip to content

Commit a466041

Browse files
Apply suggestions from code review
Co-authored-by: Patricia Santa Ana <[email protected]>
1 parent cc15a33 commit a466041

File tree

1 file changed

+5
-4
lines changed

1 file changed

+5
-4
lines changed

src/content/docs/turnstile/tutorials/conditionally-enforcing-turnstile.mdx

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,15 +15,16 @@ This tutorial explains how to conditionally enforce Turnstile based on the incom
1515

1616
## Overview
1717

18-
Occasionally, you might have setups such as automation that cannot load or run the Turnstile challenge. This tutorial will demonstrate using [`HTMLRewriter`](/workers/runtime-apis/html-rewriter/) to conditionally handle the [client-side widget](/turnstile/get-started/client-side-rendering/) and [siteverify API](/turnstile/get-started/server-side-validation/) when specific criteria are met.
19-
20-
Whilst this tutorial demonstrates removing the Turnstile client-side elements when criteria are met, you could instead conditionally insert them if you prefer.
18+
You may have setups such as automation that cannot load or run the Turnstile challenge. Using [`HTMLRewriter`](/workers/runtime-apis/html-rewriter/), this tutorial will demonstrate how to conditionally handle the [client-side widget](/turnstile/get-started/client-side-rendering/) and [siteverify API](/turnstile/get-started/server-side-validation/) when specific criteria are met.
2119

20+
:::note
21+
While this tutorial removes Turnstile client-side elements when specific criteria are met, you could instead conditionally insert them.
22+
:::
2223
:::caution
2324

2425
It is critical to make sure you are validating tokens with the siteverify API when your criteria for enforcing Turnstile are not met.
2526

26-
It is not sufficient to just remove the client-side widget from the page, as an attacker could simply forge the request to your API.
27+
It is not sufficient to only remove the client-side widget from the page, as an attacker can forge the request to your API.
2728

2829
:::
2930

0 commit comments

Comments
 (0)