git:20260903.a1c4e3b to git:20260903.509d206

---

name: turnstile-auth-fix

category: security

description: Fix captcha failures in auth forms.

---

# Cloudflare Turnstile Fix Protocol 🔓

## Root Cause Pattern

1. Widget render in hidden container: `offsetParent === null` → render skipped

2. Widget renders before modal is visible → token not generated → `captcha_failed` response

3. Frontend error handler masks all errors as "Email or password incorrect"

- See `references/supabase-captcha-protection.md` for how to disable via dashboard

## Alternative: Disable Captcha at Account Level (RECOMMENDED)

If captcha continues failing even after fix attempts, disable protection in Supabase dashboard:

1. Buka: https://supabase.com/dashboard/project/{project}/auth/settings

2. Scroll ke **"Authentication Settings"** atau **""CAPTCHA Protection""** section

3. Set options ke DISABLED/OFF:

- Enable email confirmations → OFF / DISABLED

- Turnstile/CAPTCHA protection → OFF / DISABLED

4. Klik **""Save Changes""**

5. Hard refresh frontend: Ctrl + Shift + R

6. Test login → should work immediately!

### Alternative: Backend Code-Level Disable

For testing or production bypass without dashboard access:

```javascript

// In app.js handleLogin function:

const ENABLE_TURNSTILE = false; // Comment out captcha requirement

let captchaToken = '';

if (ENABLE_TURNSTILE) {

// Original wait loop logic...

}

await sb.auth.signInWithPassword({ email, password, options: { captchaToken } });

```

**Note:** This reduces security but works for internal/testing use. Re-enable later after fixing Cloudflare domain whitelist.

## Critical Pattern: Supabase Server-Side Token Enforcement

⚠️ **Supabase rejects requests without valid token even with empty string or fake tokens**:

See [`references/supabase-turnstile-rejection.md`](./references/supabase-turnstile-rejection.md) for:

- Network error patterns (`captcha_failed`)

- Solution hierarchy (disable dashboard → backend bypass → domain config)

- Diagnostic checklist

- Prevention strategies

## Environment Notes

- Browser automation: Turnstile often blocks automated access → cannot verify

- Chrome native: usually resolved with the fix above

## Prevention

- Render Turnstile **after** container visible

- Wait for token to be ready before submitting form

- Always test login flow after deploying Turnstile changes

- **Disable Supabase CAPTCHA Protection** via dashboard if captcha continues failing (see `references/supabase-captcha-protection.md`)

---

*Created: 2026-08-26 | Session: PayStore captcha fix | Updated: Supabase CAPTCHA Protection insight*

Linked Files:

- [`references/supabase-captcha-protection.md`](./references/supabase-captcha-protection.md) — Dashboard settings guide for disabling Captcha at account level