Type
Product improvement
Description
Turnstile shouldn’t break when the Chrome flag –disable-web-security is used.
Benefit
Blind, disabled, and many other people rely on the Chrome flag –disable-web-security to allow Chrome extensions access to images on the webpage. Otherwise, reading these images results in a CORs security exception, since the chrome extension script is considered “loaded” after.
Originally, Turnstile allowed this flag. Now it results in an infinite loop redirect. As of February 4th, 2025, this has been broken.
Repro steps:
- Launch chrome with
--disable-web-security --user-data-dir="C:\temp\unlock"(Windows) - Every Cloudflare Turnstile site now rejects the browser with an infinite refresh loop.