41 lines
1.1 KiB
PHP
41 lines
1.1 KiB
PHP
<?php
|
|
|
|
namespace App\Rules;
|
|
|
|
use Closure;
|
|
use Illuminate\Contracts\Validation\ValidationRule;
|
|
use Illuminate\Support\Facades\Http;
|
|
use Illuminate\Support\Facades\Request;
|
|
|
|
/**
|
|
* Verifies a Cloudflare Turnstile response token server-side. A no-op when
|
|
* services.turnstile.secret_key isn't configured, so environments without
|
|
* Turnstile keys (local, CI) aren't blocked.
|
|
*/
|
|
class Turnstile implements ValidationRule
|
|
{
|
|
public function validate(string $attribute, mixed $value, Closure $fail): void
|
|
{
|
|
$secret = config('services.turnstile.secret_key');
|
|
|
|
if (blank($secret)) {
|
|
return;
|
|
}
|
|
|
|
if (blank($value)) {
|
|
$fail(__('Please complete the verification challenge.'));
|
|
|
|
return;
|
|
}
|
|
|
|
$response = Http::asForm()->post('https://challenges.cloudflare.com/turnstile/v0/siteverify', [
|
|
'secret' => $secret,
|
|
'response' => $value,
|
|
'remoteip' => Request::ip(),
|
|
]);
|
|
|
|
if (! $response->json('success', false)) {
|
|
$fail(__('The verification challenge failed. Please try again.'));
|
|
}
|
|
}
|
|
}
|