// This is the demo secret key. In production, we recommend
// you store your secret key(s) safely.
const SECRET_KEY = "1x0000000000000000000000000000000AA";
async function handlePost(request) {
const body = await request.formData();
// Turnstile injects a token in "cf-turnstile-response".
const token = body.get("cf-turnstile-response");
const ip = request.headers.get("CF-Connecting-IP");
// Validate the token by calling the
// "/siteverify" API endpoint.
let formData = new FormData();
formData.append("secret", SECRET_KEY);
formData.append("response", token);
formData.append("remoteip", ip);
const url = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
const result = await fetch(url, {
body: formData,
method: "POST",
});
const outcome = await result.json();
if (outcome.success) {
// ...
}
}
此步驟確保 token 是有效的，且未被重複使用，防止重放攻擊。
4. 從 Google reCAPTCHA 遷移
如果你目前使用的是 Google reCAPTCHA，可以使用 Turnstile 的兼容模式，修改載入腳本：
Cross-Origin Resource Sharing (CORS) is an HTTP-header based mechanism that allows a server to indicate any origins (domain, scheme, or port) other than its own from which a browser should permit …
Documentation for Cloudflare Workers, a serverless execution environment that allows you to create entirely new applications or augment existing ones without configuring or maintaining infrastructure.
他可以作為 client to server 的 middleware 或是當作是一個終端。 serverless 的服務各大 vps 商也都有，像是 AWS 、GCP、Azure 等，這裡也有篇 Linode 關於 Serverless Computing 的優缺點介紹。
值得一提的是他還有 wokers router 服務，以及 workers KV 服務，提供了路由和儲存的實作，有興趣可以玩玩看。另外在 workers 的設定中，如果同一個帳號中也有使用 name server 的服務，可以調整自定義網域的作法，將子域名指定過去，這樣就不用記很奇怪的域名啦。
By default, users have access to the Workers Free plan. The Workers free plan includes limited usage of Workers, Pages Functions and Workers KV. Read …
