By editing or creating a new Turnstile widget with “Pre-Clearance” enabled, Cloudflare customers can now use Turnstile to issue a challenge when a page’s HTML loads, and enforce that all valid responses have a valid Turnstile token. They can then write a Cloudflare WAF rule to challenge all requests to their API. The Cloudflare WAF will check for a valid clearance cookie before sending requests to the API.

Cloudflare's platform is a leading provider of internet security and performance solutions, offering insights into web security, content delivery, and DNS management. Through documentation, blog posts, and webinars, Cloudflare provides insights into protecting websites and applications from cyber threats and improving performance. Developers and IT professionals can learn about CDN (Content Delivery Network), DDoS mitigation, and firewall configurations to secure and accelerate web traffic.

Cloudflare

Cloudflare has integrated Turnstile with its Web Application Firewall (WAF), allowing web admins to add Turnstile to their websites and configure the WAF to manage fetch requests. This solves the problem of browsers not being able to render the HTML necessary for a challenge to run on fetch requests. Turnstile Pre-Clearance mode offers improved user experience, allows blocking more requests at the edge, and provides optional security for integrated APIs.

Integrating Turnstile with the Cloudflare WAF to challenge fetch requests

Challenging fetch requests in the Cloudflare WAF

Implementing Turnstile with Pre-Clearance

Pre-Clearance is available to all Cloudflare customers