Repository navigation
Add Cloudflare Turnstile verification to the contact form - #198
Merged
Merged
Conversation
Signed-off-by: ianmuchyri <ianmuchiri8@gmail.com>
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
absmach-website | eed1bbc | Commit Preview URL Branch Preview URL |
Oct 19 2026, 08:24 AM |
Signed-off-by: ianmuchyri <ianmuchiri8@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a Cloudflare Turnstile check to the contact form so bot submissions are rejected before any email is sent.
contact.astro: renders the Turnstile widget (actioncontact) above the submit button, blocks submission until the check is complete, and resets the widget after each attempt since tokens are single-use. The sitekey is public and defaults to the production widget;PUBLIC_TURNSTILE_SITEKEYoverrides it at build time.api/contact.js: after field validation, verifies the token with Siteverify and only sends mail when it succeeds, the action iscontact, and the hostname is inTURNSTILE_HOSTNAMES. Verification failures return 403; a missing secret or hostname list returns 503, so the form fails closed.wrangler.jsonc:TURNSTILE_HOSTNAMES=absmach.eu,www.absmach.eu..dev.vars.example:TURNSTILE_SECRETandTURNSTILE_HOSTNAMES=localhost,127.0.0.1for local dev.eslint.config.mjs: allow theAbortSignalglobal in API routes (used for the 10s Siteverify timeout).Deployment
TURNSTILE_SECRETmust be set as a secret on theabsmach-websiteWorker (already done).*.workers.devURLs are not inTURNSTILE_HOSTNAMES, so the form returns 403 there.Testing
pnpm checkandpnpm buildpass.wrangler dev: missing token and a token without thecontactaction are rejected with 403; the honeypot path is unchanged; the client blocks submission until the widget is completed; a real submission passes verification.