How can I integrate Cloudflare Turnstile with Discourse?

[pfaffman (Jay Pfaffman)]

@Lee_Ars

When I stood up my current discourse instance this past summer, I had about 100 spam accounts sign up within 24 hours, all with throwaway email domain accounts (all of which had functional SPF and DKIM). Turning on hCaptcha eliminated the problem entirely.

Wow. That’s crazy. Show’s what I know!

I think it should be possible with a theme component–if the Bad Actors are using the javascript front end and not the API (in which case Turnstile wouldn’t make a difference).

Anyway, I can’t quite tell how it works, but it’s possible that my GitHub - literatecomputing/discourse-custom-components · GitHub theme component would let you paste whatever it is that Cloudflare gives you into the component and have it render on some place on the signup form.

Edit: oh, but that’ll just put the captcha on the page, I guess, not require it to submit the form.

What is required

There’s a client side piece: Embed the widget · Cloudflare Turnstile docs

And a server-side piece: Validate the token · Cloudflare Turnstile docs

You’d first need to add the client-side piece and see that the stuff from there gets submitted with the account-creation data. Then the server-side piece would validate that they indeed passed the test. I’m not quite sure how hard it would be, I’m guessing $500-2000 would get someone to do it in Marketplace.