🛡️ Как подключить Cloudflare Turnstile на production: полный гайд для любого веб-проекта¶

# utils/turnstile.py
import requests
import logging
from django.conf import settings

logger = logging.getLogger(__name__)

def verify_turnstile_token(token: str, remote_ip: str = None) -> dict:
    """
    Проверяет токен Turnstile на сервере.
    Возвращает dict с результатом валидации.
    """
    if not settings.TURNSTILE_ENABLED:
        return {"success": True}  # отключаем проверку в dev

    url = "https://challenges.cloudflare.com/turnstile/v0/siteverify"
    data = {
        "secret": settings.TURNSTILE_SECRET_KEY,
        "response": token,
    }
    if remote_ip:
        data["remoteip"] = remote_ip

    try:
        response = requests.post(
            url, 
            data=data, 
            timeout=10,  # не блокировать надолго
            headers={"User-Agent": "YourApp/1.0"}
        )
        response.raise_for_status()
        result = response.json()

        # Логирование для мониторинга
        if result.get("success"):
            logger.info(f"Turnstile OK: {result.get('hostname')}")
        else:
            logger.warning(f"Turnstile FAIL: {result.get('error-codes')}")

        return result

    except requests.RequestException as e:
        logger.error(f"Turnstile API error: {e}")
        # Fail-closed: при ошибке сети отклоняем запрос
        return {"success": False, "error-codes": ["internal-error"]}

# views.py
from django.http import JsonResponse
from django.views.decorators.http import require_POST
from .utils.turnstile import verify_turnstile_token

@require_POST
def contact_form_submit(request):
    token = request.POST.get("cf-turnstile-response")

    # Получаем IP (учитываем прокси)
    remote_ip = (
        request.META.get("HTTP_CF_CONNECTING_IP") or
        request.META.get("HTTP_X_FORWARDED_FOR", "").split(",")[0].strip() or
        request.META.get("REMOTE_ADDR")
    )

    # Валидация токена
    validation = verify_turnstile_token(token, remote_ip)

    if not validation.get("success"):
        errors = validation.get("error-codes", ["unknown"])
        return JsonResponse({
            "error": "Подтвердите защиту от роботов и отправьте форму снова",
            "details": errors  # только для логирования, не показывать пользователю
        }, status=400)

    # ✅ Токен валиден — обрабатываем форму
    # ... ваша логика сохранения ...

    return JsonResponse({"status": "ok"})

// middleware/turnstile.js
const axios = require('axios');

async function verifyTurnstile(token, remoteIp) {
  if (process.env.NODE_ENV !== 'production' && !process.env.TURNSTILE_ENABLED) {
    return { success: true };
  }

  try {
    const response = await axios.post(
      'https://challenges.cloudflare.com/turnstile/v0/siteverify',
      new URLSearchParams({
        secret: process.env.TURNSTILE_SECRET_KEY,
        response: token,
        ...(remoteIp && { remoteip: remoteIp })
      }),
      {
        timeout: 10000,
        headers: { 'Content-Type': 'application/x-www-form-urlencoded' }
      }
    );

    return response.data;
  } catch (error) {
    console.error('Turnstile validation error:', error.message);
    return { success: false, 'error-codes': ['internal-error'] };
  }
}

module.exports = { verifyTurnstile };

// routes/forms.js
const express = require('express');
const { verifyTurnstile } = require('../middleware/turnstile');
const router = express.Router();

router.post('/contact', async (req, res) => {
  const token = req.body['cf-turnstile-response'];
  const remoteIp = req.headers['cf-connecting-ip'] || 
                   req.headers['x-forwarded-for']?.split(',')[0] || 
                   req.ip;

  const validation = await verifyTurnstile(token, remoteIp);

  if (!validation.success) {
    return res.status(400).json({
      error: 'Подтвердите защиту от роботов и отправьте форму снова',
      // Не раскрывайте error-codes клиенту в production
    });
  }

  // ✅ Обрабатываем форму
  // ...

  res.json({ status: 'ok' });
});

// app/Services/TurnstileService.php
namespace App\Services;

use Illuminate\Support\Facades\Http;
use Illuminate\Support\Facades\Log;

class TurnstileService
{
    public function verify(string $token, ?string $remoteIp = null): array
    {
        if (!config('services.turnstile.enabled')) {
            return ['success' => true];
        }

        try {
            $response = Http::timeout(10)->asForm()->post(
                'https://challenges.cloudflare.com/turnstile/v0/siteverify',
                [
                    'secret' => config('services.turnstile.secret_key'),
                    'response' => $token,
                    'remoteip' => $remoteIp,
                ]
            );

            $result = $response->json();

            if ($result['success'] ?? false) {
                Log::info('Turnstile verified', ['hostname' => $result['hostname'] ?? null]);
            } else {
                Log::warning('Turnstile failed', ['errors' => $result['error-codes'] ?? []]);
            }

            return $result;

        } catch (\Exception $e) {
            Log::error('Turnstile API error', ['message' => $e->getMessage()]);
            return ['success' => false, 'error-codes' => ['internal-error']];
        }
    }
}

// config/services.php
'turnstile' => [
    'enabled' => env('TURNSTILE_ENABLED', false),
    'site_key' => env('TURNSTILE_SITE_KEY'),
    'secret_key' => env('TURNSTILE_SECRET_KEY'),
],