search

instrumentl / rails-cloudflare-turnstile

ISC License
25 stars 13 forks source link

Secret key getting loaded into site key as concatenated value. #189

Open fauxstor opened 2 weeks ago

fauxstor commented 2 weeks ago

Ruby 3.2.4, rails 7.2.2, gem version 0.2.1

% env | grep TURNSTILE
TURNSTILE_SITE_KEY=COOL
TURNSTILE_SECRET_KEY=NOT_COOL
% r c
Loading development environment (Rails 7.2.2)
3.2.4 :001 > RailsCloudflareTurnstile.configuration
 =>
#<RailsCloudflareTurnstile::Configuration:0x000000010b0f19a8
 @enabled=true,
 @fail_open=true,
 @mock_enabled=true,
 @secret_key="NOT_COOL",
 @site_key=["COOL", "NOT_COOL"],
 @size=:regular,
 @theme=:auto,
 @timeout=5.0,
 @validation_url="https://challenges.cloudflare.com/turnstile/v0/siteverify">

As a result, the helper tag cloudflare_turnstile generates data-sitekey value of the public and private key.

<div class="cloudflare-turnstile"><div class="cf-turnstile" data-sitekey="COOL NOT_COOL" data-size="regular" data-action="other" data-theme="auto"></div></div>

Initializer file cloudflare_turnstile.rb is as follows:

RailsCloudflareTurnstile.configure do |c|
  c.site_key = ENV.fetch("TURNSTILE_SITE_KEY"),
  c.secret_key = ENV.fetch("TURNSTILE_SECRET_KEY")
  c.fail_open = true
end