Skip to content

Commit d9ba18a

Browse files
preclearance cookies
1 parent 8af75ad commit d9ba18a

File tree

5 files changed

+55
-28
lines changed

5 files changed

+55
-28
lines changed

src/content/docs/turnstile/concepts/pre-clearance-support.mdx

Lines changed: 19 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -6,46 +6,40 @@ sidebar:
66

77
---
88

9-
You can integrate Cloudflare challenges on single-page applications (SPAs) by allowing Turnstile to issue a clearance cookie. The clearance level is set upon widget creation or widget modification using the Turnstile API's `clearance_level`. Possible values for the configuration are `no_clearance`, `jschallenge`, `managed`, or `interactive`. All widgets are set to `no_clearance` by default.
9+
Pre-clearance in Turnstile allows websites to streamline user experiences by using clearance cookies. These cookies enable visitors to bypass WAF challenges downstream, based on the security clearance level set by the customer. This can be particularly useful for trusted visitors, enhancing usability while maintaining security.
1010

11-
For Enterprise customers eligible to toggle off domain checks, Cloudflare recommends issuing clearance cookies on widgets where at least one domain is specified.
11+
You can integrate Cloudflare challenges by allowing Turnstile to issue a pre-clearance cookie. The pre-clearance level is set upon widget creation or widget modification using the Turnstile API's `clearance_level`. Possible values for the configuration are:
12+
13+
- `no_clearance`
14+
- `jschallenge`
15+
- `managed`
16+
- `interactive`
17+
18+
All widgets are set to `no_clearance` by default.
19+
20+
For Enterprise customers eligible to toggle off domain checks, Cloudflare recommends issuing pre-clearance cookies on widgets where at least one domain is specified.
1221

1322
:::note
1423

1524
Clearance cookies only support zones that are orange-clouded.
1625
:::
1726

18-
Refer to the [blog post](https://blog.cloudflare.com/integrating-turnstile-with-the-cloudflare-waf-to-challenge-fetch-requests) for an example of pre-clearance implementation.
19-
2027
## Pre-clearance level options
2128

22-
- **Interactive**: Interactive Pre-clearance allows a user with a clearance cookie to not be challenged by Interactive, Managed Challenge, or JavaScript Challenge Firewall Rules
23-
- **Managed**: Managed allows a user with a clearance cookie to not be challenged by Managed Challenge or JavaScript Challenge Firewall Rules
24-
- **Non-interactive**: Non-interactive allows a user with a clearance cookie to not be challenged by JavaScript Challenge Firewall Rules
29+
- **Interactive (High)**: Allows a user with a clearance cookie to not be challenged by Interactive, Managed Challenge, or JavaScript Challenge Firewall Rules
30+
- **Managed (Medium)**: Allows a user with a clearance cookie to not be challenged by Managed Challenge or JavaScript Challenge Firewall Rules
31+
- **Non-interactive (Low)**: Allows a user with a clearance cookie to not be challenged by JavaScript Challenge Firewall Rules
2532

26-
### Duration
33+
## Clearance cookie duration
2734

2835
Clearance cookies generated by the Turnstile widget will be valid for the time specified by the zone-level Challenge Passage value. To configure the Challenge Passage setting, refer to the [WAF documentation](/waf/tools/challenge-passage/).
2936

30-
## Enable pre-clearance on a new site
31-
32-
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select your account.
33-
2. Go to **Turnstile** > **Add widget**.
34-
3. Under **Would you like to opt for pre-clearance for this site?** select **Yes**.
35-
4. Choose the pre-clearance level from the select box.
36-
5. Select **Create**.
37-
38-
## Enable pre-clearance on an existing site
39-
40-
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select your account.
41-
2. Go to **Turnstile**.
42-
3. Go to the existing widget or site and select **Settings**.
43-
4. Under **Would you like to opt for pre-clearance for this site?** select **Yes**.
44-
5. Choose the pre-clearance level from the select box.
45-
6. Select **Update**.
46-
4737
## Verified bots
4838

4939
If a [verified bot](/bots/concepts/bot/#verified-bots) encounters a page where a Turnstile widget is implemented, the challenge will fail and the verified bot will see a `403` error from the Turnstile endpoint.
5040

5141
However, if a verified bot is excluded from the rule which pre-clearance will grant clearance for, it will pass. Users can create a [WAF custom rule](/waf/custom-rules/) to exclude verified bots.
42+
43+
## Setup
44+
45+
To set up pre-clearance cookies, refer to [Enable pre-clearance cookies](/turnstile/get-started/pre-clearance/).

src/content/docs/turnstile/get-started/mobile-implementation.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: Mobile implementation
33
pcx_content_type: concept
44
sidebar:
5-
order: 5
5+
order: 6
66

77
---
88

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
title: Enable pre-clearance cookies
3+
pcx_content_type: get-started
4+
sidebar:
5+
order: 3
6+
label: Pre-clearance cookies
7+
8+
---
9+
10+
## Prerequisites
11+
12+
To enable pre-clearance, you must ensure that the hostname of the Turnstile widget matches the zone with the WAF rules. During the Turnstile configuration setup in the Cloudflare dashboard, you can see the registered zones. Select the appropriate hostname from this list.
13+
14+
The prerequisite is crucial for pre-clearance to function properly. If set up correctly, visitors who successfully solve Turnstile will receive a cookie with the security clearance level set by the customer. When encountering a WAF challenge on the same zone, they will bypass additional challenges for the configured clearance level and below.
15+
16+
For more details on managing hostnames, refer to the [Hostname Management documentation](/turnstile/concepts/hostname-management/).
17+
18+
## Enable pre-clearance on a new site
19+
20+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select your account.
21+
2. Go to **Turnstile** > **Add widget**.
22+
3. Under **Would you like to opt for pre-clearance for this site?** select **Yes**.
23+
4. Choose the pre-clearance level from the select box.
24+
5. Select **Create**.
25+
26+
## Enable pre-clearance on an existing site
27+
28+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select your account.
29+
2. Go to **Turnstile**.
30+
3. Go to the existing widget or site and select **Settings**.
31+
4. Under **Would you like to opt for pre-clearance for this site?** select **Yes**.
32+
5. Choose the pre-clearance level from the select box.
33+
6. Select **Update**.

src/content/docs/turnstile/get-started/supported-browsers.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,6 @@ pcx_content_type: concept
33
title: Supported browsers
44
external_link: /waf/reference/cloudflare-challenges/#browser-support
55
sidebar:
6-
order: 4
6+
order: 5
77

88
---

src/content/docs/turnstile/get-started/terraform.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
pcx_content_type: how-to
33
title: Terraform
44
sidebar:
5-
order: 3
5+
order: 4
66
---
77

88
:::note[Requirements]

0 commit comments

Comments
 (0)