From 59c5c0f5a7bcacf116e080a16a89b83729d42052 Mon Sep 17 00:00:00 2001 From: Bryce Kalow Date: Wed, 24 Jul 2024 12:52:15 -0500 Subject: [PATCH 1/5] Do not send captcha params for oauth_google --- .../clerk-js/src/core/resources/SignUp.ts | 23 ++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/packages/clerk-js/src/core/resources/SignUp.ts b/packages/clerk-js/src/core/resources/SignUp.ts index d4348b4c30e..0d8de95b69e 100644 --- a/packages/clerk-js/src/core/resources/SignUp.ts +++ b/packages/clerk-js/src/core/resources/SignUp.ts @@ -71,7 +71,13 @@ export class SignUp extends BaseResource implements SignUpResource { const { captchaSiteKey, canUseCaptcha, captchaURL, captchaWidgetType, captchaProvider, captchaPublicKeyInvisible } = retrieveCaptchaInfo(SignUp.clerk); - if (canUseCaptcha && captchaSiteKey && captchaURL && captchaPublicKeyInvisible) { + if ( + !this.shouldBypassCaptchaForAttempt(params) && + canUseCaptcha && + captchaSiteKey && + captchaURL && + captchaPublicKeyInvisible + ) { try { const { captchaToken, captchaWidgetTypeUsed } = await getCaptchaToken({ siteKey: captchaSiteKey, @@ -91,6 +97,10 @@ export class SignUp extends BaseResource implements SignUpResource { } } + if (params.transfer && this.shouldBypassCaptchaForAttempt(params)) { + paramsWithCaptcha.strategy = SignUp.clerk.client?.signIn.firstFactorVerification.strategy; + } + return this._basePost({ path: this.pathRoot, body: normalizeUnsafeMetadata(paramsWithCaptcha), @@ -264,4 +274,15 @@ export class SignUp extends BaseResource implements SignUpResource { } return this; } + + protected shouldBypassCaptchaForAttempt(params: SignUpCreateParams) { + if (params.strategy === 'oauth_google') { + return true; + } + if (params.transfer && SignUp.clerk.client?.signIn.firstFactorVerification.strategy === 'oauth_google') { + return true; + } + + return false; + } } From 3f428f475ed2bc01c6125af694f84825dd62df23 Mon Sep 17 00:00:00 2001 From: Bryce Kalow Date: Wed, 24 Jul 2024 12:53:34 -0500 Subject: [PATCH 2/5] Adds changeset --- .changeset/rude-wasps-wonder.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/rude-wasps-wonder.md diff --git a/.changeset/rude-wasps-wonder.md b/.changeset/rude-wasps-wonder.md new file mode 100644 index 00000000000..55eb138a2af --- /dev/null +++ b/.changeset/rude-wasps-wonder.md @@ -0,0 +1,5 @@ +--- +"@clerk/clerk-js": patch +--- + +Adjust how we pass captcha tokens to the Clerk API when signing in with Google. From 7d200e748e70e240f4883375d354bc77c90c78c8 Mon Sep 17 00:00:00 2001 From: Kevin Wang Date: Wed, 24 Jul 2024 14:13:57 -0400 Subject: [PATCH 3/5] bypassCaptcha for `oauth_microsoft` & `oauth_apple` strategies as well --- packages/clerk-js/src/core/resources/SignUp.ts | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/packages/clerk-js/src/core/resources/SignUp.ts b/packages/clerk-js/src/core/resources/SignUp.ts index 0d8de95b69e..2d177597941 100644 --- a/packages/clerk-js/src/core/resources/SignUp.ts +++ b/packages/clerk-js/src/core/resources/SignUp.ts @@ -276,10 +276,19 @@ export class SignUp extends BaseResource implements SignUpResource { } protected shouldBypassCaptchaForAttempt(params: SignUpCreateParams) { - if (params.strategy === 'oauth_google') { + if ( + params.strategy === 'oauth_google' || + params.strategy === 'oauth_microsoft' || + params.strategy === 'oauth_apple' + ) { return true; } - if (params.transfer && SignUp.clerk.client?.signIn.firstFactorVerification.strategy === 'oauth_google') { + if ( + params.transfer && + (SignUp.clerk.client?.signIn.firstFactorVerification.strategy === 'oauth_google' || + SignUp.clerk.client?.signIn.firstFactorVerification.strategy === 'oauth_microsoft' || + SignUp.clerk.client?.signIn.firstFactorVerification.strategy === 'oauth_apple') + ) { return true; } From cfba6d4183de69d62cb732565cee60ed0f23e95f Mon Sep 17 00:00:00 2001 From: Bryce Kalow Date: Wed, 24 Jul 2024 14:13:23 -0500 Subject: [PATCH 4/5] Update .changeset/rude-wasps-wonder.md Co-authored-by: Kevin Wang <26389321+thiskevinwang@users.noreply.github.com> --- .changeset/rude-wasps-wonder.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.changeset/rude-wasps-wonder.md b/.changeset/rude-wasps-wonder.md index 55eb138a2af..6f6874a522d 100644 --- a/.changeset/rude-wasps-wonder.md +++ b/.changeset/rude-wasps-wonder.md @@ -2,4 +2,4 @@ "@clerk/clerk-js": patch --- -Adjust how we pass captcha tokens to the Clerk API when signing in with Google. +Adjust how we pass captcha tokens to the Clerk API when signing in with Google, Microsoft, and Apple From d0b80d2c549b030d2893bb5187df77c57dac8a15 Mon Sep 17 00:00:00 2001 From: Bryce Kalow Date: Wed, 24 Jul 2024 17:05:18 -0500 Subject: [PATCH 5/5] Adds a comment --- packages/clerk-js/src/core/resources/SignUp.ts | 3 +++ 1 file changed, 3 insertions(+) diff --git a/packages/clerk-js/src/core/resources/SignUp.ts b/packages/clerk-js/src/core/resources/SignUp.ts index 2d177597941..6b610699b28 100644 --- a/packages/clerk-js/src/core/resources/SignUp.ts +++ b/packages/clerk-js/src/core/resources/SignUp.ts @@ -275,6 +275,9 @@ export class SignUp extends BaseResource implements SignUpResource { return this; } + /** + * We delegate bot detection to the following providers, instead of relying on turnstile exclusively + */ protected shouldBypassCaptchaForAttempt(params: SignUpCreateParams) { if ( params.strategy === 'oauth_google' ||