Tuesday, March 4, 2025
1 change · saas-18.1
Enhancements to existing features
Website forms protected by Cloudflare Turnstile now keep the submit button unavailable until the check is ready or completed. This reduces failed or premature submissions, including cases triggered by pressing Enter or automatic password-manager submission.
Original PR description
Updated the default behavior to ensure a smoother user experience. Now, the submit button is disabled by default and enabled only after Turnstile has finished loading, whether the captcha is resolved silently or the user passes the challenge manually. This commit introduces a new required, invisible input that is validated only in the callback. This prevents alternatives for form submission, such as pressing Enter inside an input field or password managers that autofill the user/password and autosubmit the form. Note: We don't use a hidden input type because, according to the HTML spec, hidden inputs are not subject to constraint validation.