Documentation
¶
Overview ¶
Package turnstile checks a Cloudflare Turnstile token with the siteverify API, as documented at https://developers.cloudflare.com/turnstile/get-started/server-side-validation/: a form POST of the widget's secret key and the token, answered by a JSON object. The visitor's address, optional, is never sent.
A token is valid once and for 300 seconds, so a check is never retried: a second try of the same token is refused as a duplicate. The secret and the token are never logged nor quoted in an error.
Index ¶
Constants ¶
const SiteverifyURL = "https://" + siteverifyHost + "/turnstile/v0/siteverify"
SiteverifyURL is the endpoint of the siteverify API.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Submitter ¶
type Submitter interface {
Submit(ctx context.Context, rawURL, contentType string, body []byte) ([]byte, error)
}
Submitter posts a body and returns the answer; *httpclient.Client is one. Its errors must not quote the body.
type Verifier ¶
type Verifier struct {
// contains filtered or unexported fields
}
Verifier checks the tokens of one Turnstile widget, served on one hostname.
func New ¶
New returns a Verifier posting through client the secret key of the widget, whose valid tokens name hostname.
func NewLive ¶
NewLive returns a Verifier reaching siteverify through an HTTP client allowed on its host only, trying each token once.
Source Files