From 2ce3472b1dd20935aa58ad301b06921470a9c72d Mon Sep 17 00:00:00 2001 From: serhiizghama Date: Fri, 22 May 2026 08:49:25 +0700 Subject: [PATCH 1/2] fix(website): remove invalid Turnstile size 'invisible' from render options Cloudflare Turnstile does not accept 'invisible' as a size value; the valid options are 'normal', 'compact', and 'flexible'. Passing 'invisible' throws a TurnstileException in recent Turnstile script versions, breaking the pack form. The invisible behaviour is already achieved via execution: 'execute', which defers the challenge until mintToken() is called. The size parameter is only needed when rendering a visible widget. --- website/client/composables/useTurnstile.ts | 1 - website/client/composables/useTurnstileScript.ts | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/website/client/composables/useTurnstile.ts b/website/client/composables/useTurnstile.ts index 80d6cc00e..25cf88260 100644 --- a/website/client/composables/useTurnstile.ts +++ b/website/client/composables/useTurnstile.ts @@ -87,7 +87,6 @@ export function useTurnstile() { if (!widgetId.value) { widgetId.value = turnstile.render(el, { sitekey: siteKey, - size: 'invisible', action: 'pack', execution: 'execute', callback: (token: string) => { diff --git a/website/client/composables/useTurnstileScript.ts b/website/client/composables/useTurnstileScript.ts index d76236be1..93f68c753 100644 --- a/website/client/composables/useTurnstileScript.ts +++ b/website/client/composables/useTurnstileScript.ts @@ -18,7 +18,7 @@ export interface TurnstileGlobal { export interface TurnstileRenderOptions { sitekey: string; - size?: 'normal' | 'compact' | 'invisible'; + size?: 'normal' | 'compact' | 'flexible'; // `action` is bound into the issued token and verified server-side, so a // token minted for /api/pack can't be replayed at a future endpoint that // expects a different action. From 9c1d96160fa7f63934e2cc4b00c63ced535695b3 Mon Sep 17 00:00:00 2001 From: serhiizghama Date: Fri, 22 May 2026 08:49:31 +0700 Subject: [PATCH 2/2] fix(website): hide Turnstile container via CSS instead of size: invisible Without a size value, Turnstile renders a visible widget inside the container div. Collapse it with position: absolute; width/height: 0; overflow: hidden; visibility: hidden so no layout space is consumed and the widget stays inert. --- website/client/components/Home/TryIt.vue | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/website/client/components/Home/TryIt.vue b/website/client/components/Home/TryIt.vue index e7d269cd5..05768eb46 100644 --- a/website/client/components/Home/TryIt.vue +++ b/website/client/components/Home/TryIt.vue @@ -478,4 +478,16 @@ onMounted(() => { border-color: #333 transparent transparent transparent; } +/* The Turnstile widget is executed programmatically via execution: 'execute'. + The container must remain in the DOM (removing it prevents widget rendering) + but should not affect page layout or be visible. */ +.turnstile-container { + position: absolute; + width: 0; + height: 0; + overflow: hidden; + visibility: hidden; + pointer-events: none; +} +