Testing framework is passing Cloudflare Turnstile

Website, Application, Performance Turnstile
1

I setup Turnstile on my site. Whilst testing with the Cypress framework, I found out that even with production key values for both the client key and secret key, it is passing the validation with a successful validation token, simply by typing in pre-determined values into my login form.

Isnt this the exact thing that should be failing the test? If a testing bot can pass then I’m not sure what is the point of Turnstile?

2

Note: I’m using the invisible widget version.

3

I’m new to Turnstile but I don’t believe it actually looks at the form contents when performing its tests. It uses browser challenges to determine if the visitor is “real” or not. During my testing, I find Turnstile will complete the challenge before any form fields have been filled in and before the form has been submitted.