CB antispam cloudflare issue

Just tried hCaptcha and Turnstile again on the devel website.
Cloudflare seems to have CORS issues despite the fact that we authorize * on our server
hCaptcha does not issue any errors or CORS issue but the page always return Invalid Captcha code

Code Internal is working perfectly fine

You can look at the page at devel.cercle.business/cb-forgot-login
All seems fine and the widgets display ok, but as soon as you post the page, you get the Invalid Captcha code message even if the xhr checksiteconfig returns pass=true

PS you can test with lost id and my email

Not sure what to suggest. I've retested both test and live keys and secrets for both Turnstile and hCaptcha. If both are continuing to fail it's likely something conflicting or the secrets are not configured correctly or possibly the domain is not configured correctly and the verify request is being rejected. The only other possibility is something is interfering with the POST of the form and causing the captcha token to be lost.

Do you have an Enterprise/Pro hCaptcha account? That provides score based captcha. If so what is "Score Threshold" set to? Default it should be set to 0.5, but this only applies for Enterprise/Pro accounts.

I was able to find a bug with hCaptcha submitting twice client side. So this maybe what is causing a mix-up in the token before submit for server verification. It didn't cause any problems in my tests though, but have fixed it regardless in latest CB AntiSpam build release. Please let me know if that resolves your issue. I will keep digging to see if there's any possible potential issue that could be causing this, but am running out of ideas unfortunately. If issue does persist please PM backend super user login credentials for your development site and will try some test builds to output some extra debug information.

Very strange the latest build solved the issue on the devel website both for hCaptcha and Turnstile
I still have the CORS warning on Turnstile though but it did not block the page from resending the userid

Do you think these CORS warnings are an issue for business users ?

For hCaptcha this is a test free account and I need to choose between the two services now, maybe hCaptcha would be better

Anyway I'll test deeper but most issues seem solved

Very strange the latest build solved the issue on the devel website both for hCaptcha and Turnstile

Awesome! Thank you for letting us know. 😊

I still have the CORS warning on Turnstile though but it did not block the page from resending the userid

Do you think these CORS warnings are an issue for business users ?

I would recommend looking into fixing the CORS issues if you intend on using Turnstile.