You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/content/docs/turnstile/concepts/pre-clearance-support.mdx
+19-25Lines changed: 19 additions & 25 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,46 +6,40 @@ sidebar:
6
6
7
7
---
8
8
9
-
You can integrate Cloudflare challenges on single-page applications (SPAs) by allowing Turnstile to issue a clearance cookie. The clearance level is set upon widget creation or widget modification using the Turnstile API's `clearance_level`. Possible values for the configuration are `no_clearance`, `jschallenge`, `managed`, or `interactive`. All widgets are set to `no_clearance` by default.
9
+
Pre-clearance in Turnstile allows websites to streamline user experiences by using clearance cookies. These cookies enable visitors to bypass WAF challenges downstream, based on the security clearance level set by the customer. This can be particularly useful for trusted visitors, enhancing usability while maintaining security.
10
10
11
-
For Enterprise customers eligible to toggle off domain checks, Cloudflare recommends issuing clearance cookies on widgets where at least one domain is specified.
11
+
You can integrate Cloudflare challenges by allowing Turnstile to issue a pre-clearance cookie. The pre-clearance level is set upon widget creation or widget modification using the Turnstile API's `clearance_level`. Possible values for the configuration are:
12
+
13
+
-`no_clearance`
14
+
-`jschallenge`
15
+
-`managed`
16
+
-`interactive`
17
+
18
+
All widgets are set to `no_clearance` by default.
19
+
20
+
For Enterprise customers eligible to toggle off domain checks, Cloudflare recommends issuing pre-clearance cookies on widgets where at least one domain is specified.
12
21
13
22
:::note
14
23
15
24
Clearance cookies only support zones that are orange-clouded.
16
25
:::
17
26
18
-
Refer to the [blog post](https://blog.cloudflare.com/integrating-turnstile-with-the-cloudflare-waf-to-challenge-fetch-requests) for an example of pre-clearance implementation.
19
-
20
27
## Pre-clearance level options
21
28
22
-
-**Interactive**: Interactive Pre-clearance allows a user with a clearance cookie to not be challenged by Interactive, Managed Challenge, or JavaScript Challenge Firewall Rules
23
-
-**Managed**: Managed allows a user with a clearance cookie to not be challenged by Managed Challenge or JavaScript Challenge Firewall Rules
24
-
-**Non-interactive**: Non-interactive allows a user with a clearance cookie to not be challenged by JavaScript Challenge Firewall Rules
29
+
-**Interactive (High)**: Allows a user with a clearance cookie to not be challenged by Interactive, Managed Challenge, or JavaScript Challenge Firewall Rules
30
+
-**Managed (Medium)**: Allows a user with a clearance cookie to not be challenged by Managed Challenge or JavaScript Challenge Firewall Rules
31
+
-**Non-interactive (Low)**: Allows a user with a clearance cookie to not be challenged by JavaScript Challenge Firewall Rules
25
32
26
-
### Duration
33
+
##Clearance cookie duration
27
34
28
35
Clearance cookies generated by the Turnstile widget will be valid for the time specified by the zone-level Challenge Passage value. To configure the Challenge Passage setting, refer to the [WAF documentation](/waf/tools/challenge-passage/).
29
36
30
-
## Enable pre-clearance on a new site
31
-
32
-
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select your account.
33
-
2. Go to **Turnstile** > **Add widget**.
34
-
3. Under **Would you like to opt for pre-clearance for this site?** select **Yes**.
35
-
4. Choose the pre-clearance level from the select box.
36
-
5. Select **Create**.
37
-
38
-
## Enable pre-clearance on an existing site
39
-
40
-
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select your account.
41
-
2. Go to **Turnstile**.
42
-
3. Go to the existing widget or site and select **Settings**.
43
-
4. Under **Would you like to opt for pre-clearance for this site?** select **Yes**.
44
-
5. Choose the pre-clearance level from the select box.
45
-
6. Select **Update**.
46
-
47
37
## Verified bots
48
38
49
39
If a [verified bot](/bots/concepts/bot/#verified-bots) encounters a page where a Turnstile widget is implemented, the challenge will fail and the verified bot will see a `403` error from the Turnstile endpoint.
50
40
51
41
However, if a verified bot is excluded from the rule which pre-clearance will grant clearance for, it will pass. Users can create a [WAF custom rule](/waf/custom-rules/) to exclude verified bots.
42
+
43
+
## Setup
44
+
45
+
To set up pre-clearance cookies, refer to [Enable pre-clearance cookies](/turnstile/get-started/pre-clearance/).
To enable pre-clearance, you must ensure that the hostname of the Turnstile widget matches the zone with the WAF rules. During the Turnstile configuration setup in the Cloudflare dashboard, you can see the registered zones. Select the appropriate hostname from this list.
13
+
14
+
The prerequisite is crucial for pre-clearance to function properly. If set up correctly, visitors who successfully solve Turnstile will receive a cookie with the security clearance level set by the customer. When encountering a WAF challenge on the same zone, they will bypass additional challenges for the configured clearance level and below.
15
+
16
+
For more details on managing hostnames, refer to the [Hostname Management documentation](/turnstile/concepts/hostname-management/).
17
+
18
+
## Enable pre-clearance on a new site
19
+
20
+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select your account.
21
+
2. Go to **Turnstile** > **Add widget**.
22
+
3. Under **Would you like to opt for pre-clearance for this site?** select **Yes**.
23
+
4. Choose the pre-clearance level from the select box.
24
+
5. Select **Create**.
25
+
26
+
## Enable pre-clearance on an existing site
27
+
28
+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select your account.
29
+
2. Go to **Turnstile**.
30
+
3. Go to the existing widget or site and select **Settings**.
31
+
4. Under **Would you like to opt for pre-clearance for this site?** select **Yes**.
32
+
5. Choose the pre-clearance level from the select box.
0 commit comments