omnishield/turnstile API reference

Omnishield\Turnstile

TurnstileGateway class

final class TurnstileGateway implements ChallengeInterface TurnstileGateway.php:23

A Turnstile token, checked by siteverify (https://developers.cloudflare.com/turnstile/get-started/server-side-validation/): POST secret, response, remoteip, idempotency_key; the answer's success, challenge_ts, hostname, action and error-codes. A token lasts 300 seconds, serves once, and is at most 2048 characters long.

const BASE_URI = 'https://challenges.cloudflare.com/turnstile/v0/'

const SCRIPT = 'https://challenges.cloudflare.com/turnstile/v0/api.js'

const FIELD = 'cf-turnstile-response'

const MAX_LENGTH = 2048

TurnstileGateway::__construct()

public function __construct(readonly HttpClientInterface $http, readonly string $siteKey, readonly string $secret, readonly array $attributes = [], readonly string $field = self::FIELD, readonly bool $idempotency = true, readonly string $baseUri = self::BASE_URI)

TurnstileGateway::getName()

public function getName(): string

TurnstileGateway::getTitle()

public function getTitle(): string

TurnstileGateway::capabilities()

public function capabilities(): Capabilities

TurnstileGateway::widget()

public function widget(?string $action = null): Widget

TurnstileGateway::verify()

public function verify(Attempt $attempt): Verdict

TurnstileGatewayFactory class

final class TurnstileGatewayFactory extends GatewayFactory TurnstileGatewayFactory.php:32

Cloudflare Turnstile: the widget from Cloudflare, its token checked by Cloudflare's siteverify.

options: site_key: '%env(TURNSTILE_SITE_KEY)%' # required: the widget's secret: '%env(TURNSTILE_SECRET)%' # required: siteverify's theme: auto # auto, light, dark size: normal # normal, flexible, compact appearance: always # always, execute, interaction-only language: ~ # auto, or a language: fr, de-ch attributes: } # any other data-* attribute of the widget field: cf-turnstile-response # another name sets data-response-field-name idempotency: true # a request that got no answer is sent once more, under the same idempotency_key base_uri: https://challenges.cloudflare.com/turnstile/v0/

Cloudflare's testing keys - site key 1x00000000000000000000AA, secret 1x0000000000000000000000000000000AA (passes), 2x... (fails), 3x... (a token already spent) - answer for any host and carry no action: their answers are not checked against the host and action expected.

Options

TurnstileGatewayFactory::__construct()

public function __construct(readonly ?HttpClientInterface $http = null)