62 lines
1.4 KiB
Go
62 lines
1.4 KiB
Go
|
package app
|
||
|
|
|
||
|
|
import (
|
||
|
|
"context"
|
||
|
|
"encoding/json"
|
||
|
|
"errors"
|
||
|
|
"net"
|
||
|
|
"net/http"
|
||
|
|
"net/url"
|
||
|
|
"strings"
|
||
|
|
"time"
|
||
|
|
)
|
||
|
|
|
||
|
|
type turnstileVerifyResponse struct {
|
||
|
|
Success bool `json:"success"`
|
||
|
|
ErrorCodes []string `json:"error-codes"`
|
||
|
|
}
|
||
|
|
|
||
|
|
func (a *App) verifyTurnstile(ctx context.Context, token, remoteIP string) error {
|
||
|
|
if !a.cfg.TurnstileEnabled {
|
||
|
|
return nil
|
||
|
|
}
|
||
|
|
token = strings.TrimSpace(token)
|
||
|
|
secret := strings.TrimSpace(a.cfg.TurnstileSecretKey)
|
||
|
|
if secret == "" || token == "" {
|
||
|
|
return errors.New("turnstile verification required")
|
||
|
|
}
|
||
|
|
form := url.Values{}
|
||
|
|
form.Set("secret", secret)
|
||
|
|
form.Set("response", token)
|
||
|
|
if ip := normalizeRemoteIP(remoteIP); ip != "" {
|
||
|
|
form.Set("remoteip", ip)
|
||
|
|
}
|
||
|
|
req, err := http.NewRequestWithContext(ctx, http.MethodPost, "https://challenges.cloudflare.com/turnstile/v0/siteverify", strings.NewReader(form.Encode()))
|
||
|
|
if err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
||
|
|
client := &http.Client{Timeout: 8 * time.Second}
|
||
|
|
res, err := client.Do(req)
|
||
|
|
if err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
defer res.Body.Close()
|
||
|
|
var out turnstileVerifyResponse
|
||
|
|
if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
if !out.Success {
|
||
|
|
return errors.New("turnstile verification failed")
|
||
|
|
}
|
||
|
|
return nil
|
||
|
|
}
|
||
|
|
|
||
|
|
func normalizeRemoteIP(value string) string {
|
||
|
|
host, _, err := net.SplitHostPort(strings.TrimSpace(value))
|
||
|
|
if err == nil {
|
||
|
|
return host
|
||
|
|
}
|
||
|
|
return strings.TrimSpace(value)
|
||
|
|
}
|