Example URL(s)
https://developers.cloudflare.com/turnstile/troubleshooting/client-side-errors/
https://developers.cloudflare.com/turnstile/troubleshooting/client-side-errors/error-codes/
Turnstile error code 110100 is described as "Invalid sitekey"
Turnstile error code 400020 is described as "Invalid widget size"
When passing an invalid sitekey, error 400020 (Invalid widget size) is incorrectly propagated from the server to the client rather than 110100 (Invalid sitekey). This incorrect error code is also propagated through to error-callback.
Actual Behavior
Minimal reproduction:
<!DOCTYPE html>
<html>
<head>
<script
src="https://challenges.cloudflare.com/turnstile/v0/api.js"
async
defer
></script>
<script>
function onTurnstileError(errorCode) {
// incorrectly logs: "errorCode 400020"
console.log("errorCode", errorCode);
}
</script>
</head>
<body>
<div
class="cf-turnstile"
data-sitekey="thisisnotavalidsitekey"
data-error-callback="onTurnstileError"
></div>
</body>
</html>Observing the responses to requests using various sizes:
We can observe that <h2>invalid_sitekey</h2> is returned in the HTML with along with a contradictory assignment errCode = 400020;. This incorrect errCode is then propagated via the subsequent call to postMessage. The incorrect errCode is eventually passed to error-callback.
<!DOCTYPE html>
<html lang="en-US">
<head>
...
</head>
<body>
<h2>invalid_sitekey</h2>
<script nonce="...">
(function () {
errCode = 400020;
if (window.parent) {
window.parent.postMessage(
{
source: "cloudflare-challenge",
widgetId: "2od9z",
event: "fail",
code: errCode,
},
"*",
);
}
})();
</script>
</body>
</html>Expected Behavior
When passing an invalid sitekey, 110100 (Invalid sitekey) is expected.
Additional information
I've reproduced the same behaviour using:
- normal and flexible size
- explicit (error-callback passed to turnstile.render) & implicit rendering (data-error-callback) (docs)
Aside - it would be ideal if the sitekey could (officially) be tested from the server like the secret key
Example URL(s)
https://developers.cloudflare.com/turnstile/troubleshooting/client-side-errors/
https://developers.cloudflare.com/turnstile/troubleshooting/client-side-errors/error-codes/
Turnstile error code 110100 is described as "Invalid sitekey"
Turnstile error code 400020 is described as "Invalid widget size"
When passing an invalid sitekey, error 400020 (Invalid widget size) is incorrectly propagated from the server to the client rather than 110100 (Invalid sitekey). This incorrect error code is also propagated through to
error-callback.Actual Behavior
Minimal reproduction:
Observing the responses to requests using various sizes:
We can observe that
<h2>invalid_sitekey</h2>is returned in the HTML with along with a contradictory assignmenterrCode = 400020;. This incorrecterrCodeis then propagated via the subsequent call topostMessage. The incorrecterrCodeis eventually passed toerror-callback.Expected Behavior
When passing an invalid sitekey, 110100 (Invalid sitekey) is expected.
Additional information
I've reproduced the same behaviour using:
Aside - it would be ideal if the sitekey could (officially) be tested from the server like the secret key