We use Turnstile to protect our login page. Some users have the “Desktop site” option checked in Chrome, and it appears that this causes Turnstile to fail. On the handful of devices that I can check with, this option triggers a failure 100% of the time.
I can only find one other related post on the forums, which was closed for inactivity. It seems like this issue has to affect large swaths of other users.
Any ideas for how to work around this issue? We’d prefer the Turnstile widget to require the user to press the checkbox instead of flat-out failing in this case.
It fails on all six different Android devices that I have access to, on three different networks. I have multiple other user reports that follow the same symptom, where disabling “Desktop site” resolves the issue.
I have a single user report about an iOS device, but I can’t reproduce the error on the one iOS device I have access to. I’m trying to confirm if the affected iOS device is really a good bug report.
I’m not sure that the Cloudflare team recognizes this issue as a defect. The response I got from their support team is blaming the user for having that option set on their phone…
I’ll keep pushing their team a little more, maybe I just need to get past the first layer of interns…
Their response:
"May I ask is there a point to checking the option on Chrome to force a desktop site even when you are accessing via mobile?
I would say that the Turnstile product is being correctly applied in this case.
Nice suggestion. That’s helpful and I suppose you are correct.
It’s worth pointing out that that documentation is related to the Web Application Firewall’s challenges, not Turnstile directly. But, I understand that Turnstile is based on WAF’s challenge engine, so it’s reasonable that the same limitation applies.
From what I can see, that limitation is not specifically mentioned in Turstile’s documentation.