Add Cloudflare Turnstile on session minting - #464
Merged
Merged
Conversation
Require POST /session with a verified Turnstile token when TURNSTILE_SECRET_KEY is set. The SPA runs invisible Turnstile on every session mint and 10-minute background refresh when VITE_TURNSTILE_SITE_KEY is configured. Includes privacy policy disclosure, env examples, and abuse-mitigation docs. GET /session remains available when Turnstile is disabled (local dev). Co-authored-by: xenodus <xenodus@gmail.com>
Avoids API Gateway POST route changes. Token travels in a custom header instead of the URL or request body. Includes TODO notes to migrate to POST once API Gateway exposes POST on /session. Co-authored-by: xenodus <xenodus@gmail.com>
…rors - Pass VITE_TURNSTILE_SITE_KEY from GitHub secrets into make deploy - Fix stale Turnstile JSDoc (GET + header, not POST) - Surface session bootstrap failures via searchError instead of failing silently Co-authored-by: xenodus <xenodus@gmail.com>
Reject tokens whose hostname is not gishathfetch.com (or localhost in non-prod). api.gishathfetch.com is intentionally excluded because the widget runs on the SPA, not the API host. Co-authored-by: xenodus <xenodus@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds optional Cloudflare Turnstile verification on session minting to raise the cost of scripted
/session→/searchabuse.TURNSTILE_SECRET_KEYis set,GET /sessionrequiresX-Turnstile-Token; tokens are verified server-side via Cloudflare siteverify, then the responsehostnamemust matchgishathfetch.com(orlocalhostwhenENVis notprod).api.gishathfetch.comis not accepted — the widget runs on the SPA origin only.VITE_TURNSTILE_SITE_KEYis set, invisible Turnstile runs on every session mint and 10-minute background refresh.deploy-on-merge.ymlpassesVITE_TURNSTILE_SITE_KEYfrom GitHub secrets into the frontend build.searchError.Deployment checklist
TURNSTILE_SECRET_KEYmtg-price-scrapperVITE_TURNSTILE_SITE_KEYCloudflare widget hostnames must include
gishathfetch.com(notapi.gishathfetch.com).Testing
make testPrivacy policy: updated — Turnstile disclosed in
Modals.jsx.