golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(19.3-06): warn at boot when turnstile routes have no secret (WR-08)

Browse Source 
- BuildRouter logs one warning with the route count and the production
  flag when routes name turnstile:open or turnstile:closed and the
  verifier has no secret; the secret is never logged
This commit is contained in:
Jakub Zych
2026-10-15 22:30:57 +02:00
parent caa5b5d8ff
commit d0a580c60c
4 changed files with 88 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/services/authentication.md
View File

@@ -183,7 +183,7 @@ The middleware reads the token from the `turnstile_token` field (`turnstile.fiel
| Key | Default | Controls |
|-----|---------|----------|
| `turnstile.secret` | empty | The site's secret key. Set it through `SUMMER_TURNSTILE__SECRET`; a PHP application's `TURNSTILE_SECRET` value moves to that variable. |
| `turnstile.secret` | empty | The site's secret key. Set it through `SUMMER_TURNSTILE__SECRET`; a PHP application's `TURNSTILE_SECRET` value moves to that variable. When it is empty and routes name `turnstile:open` or `turnstile:closed`, the start-up logs one warning, `surf: turnstile.secret is empty`, with the number of such routes, since they are then unprotected. |
| `turnstile.field` | `turnstile_token` | The request field carrying the token. |
Refusals are written with neutral bodies, `{"error":"turnstile_unavailable"}` (503) and `{"error":"turnstile_failed"}` (422). To keep an existing response envelope, publish a `bouncer.TurnstileWriter` on the app in your plugin's `Register`; it receives the status and the `bouncer.TurnstileVerdict`. A published `*bouncer.Turnstile` replaces the verifier built from config, for example to give it its own `http.Client`.