Conversation
Spam is getting through the reCAPTCHA v2 checkbox, and Google has moved classic reCAPTCHA keys into Google Cloud with a free tier of 10,000 verifications a month. Formsender now accepts Cloudflare Turnstile, which is free with no request cap, so move all four forms over to it. - Render the Turnstile widget and load its script from the shared formsender fields partial, which every form already includes - Gate submission on the hidden cf-turnstile-response input this form carries, replacing the call into the reCAPTCHA global - Point production at the openpowerfoundation.org Turnstile site key, which is public and pairs with the secret in the formsender-opf data bag - Point development at Cloudflare's always-passing test key, which works from localhost against a local formsender The osl-app change that passes TURNSTILE_SECRET to the container has to converge before this is merged, or the forms will reject every submission. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Lance Albertson <lance@osuosl.org>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves all four site forms from the Google reCAPTCHA v2 checkbox to Cloudflare Turnstile. Turnstile is free with no request cap, and it is better at stopping the spam currently reaching the ticket queues.
Spam is getting through the v2 checkbox, which is the variety solver farms target. Google has also moved classic reCAPTCHA keys into Google Cloud, where the free allowance is 10,000 verifications a month, and exceeding it without billing attached starts failing requests. Formsender now accepts Turnstile, so the widget is the only thing that has to change on this side.
Every form already includes the shared formsender fields partial, so swapping the widget there covers the contact, HUB, Passport and ISA RFC forms at once. The one piece that is not markup is the submit gate in the form script, which called into the reCAPTCHA global to check whether the challenge had been solved. It now reads the hidden input the Turnstile widget writes into the form being submitted, which is worth a look first in the diff.
cf-turnstile-responseinput the widget writes into the form, replacing the call into the reCAPTCHA globalopenpowerfoundation.orgTurnstile site key, which is public and pairs with the secret in the formsender-opf data bagDepends on osuosl/formsender#384 and osuosl-cookbooks/osl-app#168 landing first, and on app2 having converged, or every submission will be rejected.
References: