Add support for Cloudflare Turnsile (reCaptcha Alternative)

Features
,
1

Some time ago Cloudflare announce Turnsile - A Google ReCaptcha alternative.
It’s currently in beta. It has a similar UX to ReCaptcha, but it seems to be faster.
Cloudflare claims it’s a more user-friendly and privacy preserving alternative.
Would be great if we could choose between ReCaptcha, hCaptcha and Turnsile for Netlify Forms.

Docs: Cloudflare Turnstile · Cloudflare Turnstile docs
Demo: https://demo.turnstile.workers.dev/

2 Likes
4

Thank you for this feedback! I’ve filed a feature request but I cannot give a timeline for release at this time.

2 Likes
5

any updates on this feature request? Is this the right place to look for future updates on it?

7

no unfortunately there is not. :confused:

8

and watching this thread is the best place to see when there is one, right?

9

Any update on this? I’d love to be able to use Turnstile rather the Google ReCaptcha. It’s both more perfomant and privacy-friendly.

Any updates? Thanks

10

Currently, it’s possible to implement this yourself, but it takes some extra work. Example here: hrishikesh-k/f-78024. The most important piece being the Edge Function:

import type { Config, Context } from '@netlify/edge-functions'

export default async function (request: Request, context: Context) {
  const body = await request.clone().formData()

  const result = await fetch(
    'https://challenges.cloudflare.com/turnstile/v0/siteverify',
    {
      body: JSON.stringify({
        remoteip: context.ip,
        response: body.get('cf-turnstile-response'),
        secret: Netlify.env.get('SECRET_KEY')
      }),
      headers: {
        'content-Type': 'application/json'
      },
      method: 'POST'
    }
  )

  const outcome = await result.json()

  if (!outcome.success) {
    return Response.json(
      {
        msg: 'captcha failed'
      },
      {
        status: 400
      }
    )
  }

  return
}

export const config: Config = {
  method: 'POST',
  path: '/*'
}

You can test it: f-78024.netlify.app (the site might be deleted in future).