Skip to main content

TurnstileTask | Cloudflare Challenge

All Turnstile subtypes are automatically supported: manual, non-interactive и invisible. Therefore, there is no need to specify a subtype for a normal captcha.

Attention

If you solve Turnstile on the cloudflare 5s challenge pages, don’t forget to specify cloudflareTaskType and related fields. userAgent is required.

Object structure​

ParameterTypeRequiredValue
typeStringyesTurnstileTaskProxyless or TurnstileTask (When using a proxy).
websiteURLStringyesThe page address, where the captcha is solved.
websiteKeyStringyesTurnstile key.
proxyTypeStringyes (for TurnstileTask)http - regular http/https proxy;
https - try this option only if "http" doesn’t work (required for some custom proxies);
socks4 - socks4 proxy;
socks5 - socks5 proxy.
proxyAddressStringyes (for TurnstileTask)

The IP address of the IPv4/IPv6 proxy. Not allowed:

- using hostnames;

- using transparent proxies (where you can see the client's IP);

- using proxies on local machines.

proxyPortIntegeryes (for TurnstileTask)Proxy port.
proxyLoginStringnoProxy login.
proxyPasswordStringnoProxy password.
cloudflareTaskTypeStringnocf_clearance - if cookies are required;
token - if required token from Turnstile.
htmlPageBase64Stringyes, if cloudflareTaskType is equal to* cf_clearanceBase64 encoded html page with captcha.
userAgentStringyes, if cloudflareTaskType is specified.Only the latest UAs from Chrome are supported.
pageActionStringyes, if cloudflareTaskType is equal to* tokenThe action field, that can be found in the callback function to load the captcha.
If cloudflareTaskType is used, then action is usually “managed“ or “non-interactive“.
dataStringyes, if cloudflareTaskType is equal to* tokenThe value of the data field can be taken from the cData parameter.
pageDataStringyes, if cloudflareTaskType is equal to* tokenThe value of the pageData field can be taken from the chlPageData parameter.

Proxy for token method is not required.

These parameters are in the object that is passed during captcha creation in window.turnstile.render(el, paramsObj) function. You can get them, for example, by executing JavaScript before loading other scripts:

(function () {
  const obj = {
    render: function () {
      const { action, cData, chlPageData } = arguments[1];
        const params = [
          ["action", action],
          ["data", cData],
          ["pageData", chlPageData],
        ];
        console.table(params)
    }
  };

  Object.defineProperty(window, "turnstile", {
    get: () => {
      return obj;
    },
  });
})();

Normal Turnstile​

Request example​

Method

<https://api.capmonster.cloud/createTask>

TurnstileTask (with a proxy)​

{
  "clientKey":"dce6bcbb1a728ea8d871de6d169a2057",
  "task": {
    "type":"TurnstileTask",
    "websiteURL":"http://tsmanaged.zlsupport.com",
    "websiteKey":"0x4AAAAAAABUYP0XeMJF0xoy",
    "proxyType":"http",
    "proxyAddress":"8.8.8.8",
    "proxyPort":8080,
    "proxyLogin":"proxyLoginHere",
    "proxyPassword":"proxyPasswordHere"
  }
}

TurnstileTaskProxyless (without a proxy)​

{
    "clientKey":"dce6bcbb1a728ea8d871de6d169a2057",
    "task":
    {
        "type":"TurnstileTaskProxyless",
        "websiteURL":"http://tsmanaged.zlsupport.com",
        "websiteKey":"0x4AAAAAAABUYP0XeMJF0xoy"
    }
}

Response example

{
  "errorId":0,
  "taskId":407533072
}

Cloudflare challenge​

Request example​

Method

<https://api.capmonster.cloud/createTask>

TurnstileTask (with a proxy)​

  {
  "clientKey":"dce6bcbb1a728ea8d871de6d169a2057",
  "task": {
    "type":"TurnstileTask",
    "websiteURL":"https://nowsecure.nl",
    "websiteKey":"0x4AAAAAAADnPIDROrmt1Wwj",
    "proxyType":"http",
    "proxyAddress":"8.8.8.8",
    "proxyPort":8080,
    "proxyLogin":"proxyLoginHere",
    "proxyPassword":"proxyPasswordHere",
    "cloudflareTaskType": "cf_clearance",
    "htmlPageBase64": "PCFET0NUWVBFIGh0...vYm9keT48L2h0bWw+",
    "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"
  }
}

TurnstileTaskProxyless (without a proxy)​

  {
  "clientKey":"dce6bcbb1a728ea8d871de6d169a2057",
  "task": {
    "type":"TurnstileTask",
    "websiteURL":"https://nowsecure.nl",
    "websiteKey":"0x4AAAAAAADnPIDROrmt1Wwj",
    "cloudflareTaskType": "cf_clearance",
    "htmlPageBase64": "PCFET0NUWVBFIGh0...vYm9keT48L2h0bWw+",
    "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"
  }
}

Getting a result​

Use the getTaskResult method to get the Turnstile solution. Depending on the system load, you will receive a response after a time ranging from 5 to 20 seconds.

PropertyTypeDescription
cf_clearanceStringSpecial cloudflare cookies, that you can set.
tokenStringPass this token to the callback function.

When specify cloudflareTaskType and when not? Or how to distinguish a normal Turnstile from a Cloudflare Challenge.​

Cloudflare Challenge may look different.

Simple variant:

Stylized variants:

Челлендж органично встроен в сам сайт

Выглядит как обычная капча turnstile, но на самом деле это challenge

To finally verify the presence of Cloudflare, you can open the developer tools, see the traffic, examine the page code and see the characteristic features:

  • The first request to the site returns a 403 code:

  • The form with the id challenge-form has an action attribute, containing the __cf_chl_f_tk= parameter:

  • There are two similar <script>, tags on the page that create a new value in the window object:

Example of implementing the solution using Selenium on Node.js

const { Builder } = require('selenium-webdriver');
const chrome = require('selenium-webdriver/chrome');

(async function example() {
  const options = new chrome.Options();
  options.addArguments('--auto-open-devtools-for-tabs')

  const driver = new Builder()
    .forBrowser('chrome')
    .setChromeOptions(options)
    .build();

  try {
    driver.executeScript(`
    window.turnstile = new Proxy(window.turnstile, {
      get(target, prop) {
        if (prop === 'render') {
          return function(a, b) {
            let p = {
              type: "TurnstileTaskProxyless",
              websiteKey: b.sitekey,
              websiteURL: window.location.href,
              data: b.cData,
              pagedata: b.chlPageData,
              action: b.action,
              userAgent: navigator.userAgent
          }
          
          console.log(JSON.stringify(p))
          window.params = p;
          window.turnstileCallback = b.callback;
            return target.render.apply(this, arguments);
          }
        }
        return target[prop];
      }
    });
    `)

    driver.get('SITE WITH CAPTCHA');
    

    const params = await driver.executeScript(`
      return new Promise((resolve, reject) => {
        setTimeout(() => {
          resolve(window.params)
        }, 2000)
      })
    `);

    if (params) {
      const data = {
        clientKey: 'API KEY',
        task: {
          type: 'TurnstileTaskProxyless',
          websiteURL: params.websiteURL,
          websiteKey: params.websiteKey,
          data: params.data,
          action: params.action
        }
      }

      const createResult = await fetch('https://api.capmonster.cloud/createTask', {
        method: 'post',
        body: JSON.stringify(data)
      });

      const createTaskResult = await createResult.json()

      if (createTaskResult.taskId) {
        const asyncDelay = (timeout) =>
          new Promise(resolve => {
              setTimeout(() => {
                  resolve();
              }, timeout);
          });
        
        const getTaskResult = async (taskId) => {
          const taskResult = await fetch('https://api.capmonster.cloud/getTaskResult', {
            method: 'post',
            body: JSON.stringify({
              "clientKey":"API KEY",
              "taskId": createTaskResult.taskId
            })
          });
          const taskResponse = await taskResult.json();
          if (taskResponse.status === 'processing') {
            await asyncDelay(5000);
            return await getTaskResult(taskId)
          }
          return taskResponse;
        }
       
        const taskRes = await getTaskResult(createTaskResult.taskId)

        if (taskRes.solution) {
          await driver.executeScript(`
            window.turnstileCallback(${taskRes.solution.token});
          `);
        }
      }
      
    }

    //DO SOMETHING
  } finally {
    await driver.quit();
  }
})();