CB antispam cloudflare issue

Hello
I just implemented cloudflare turnstile and have an issue that i don't understand
Keys are properly added in the settings and our domain is duly registered at cloudflare.
On the CB forgot login page for instance I get the green success logo but when we try to get a new password the page always reload with captcha code non valid

Could you tell me what I miss here ?
Page is at  cercle.business/cb-forgot-login

Thanks

Is it just forgot login doing this or is it failing for you everywhere? Have retested login, forgot login, and registration Cloudflare Turnstile and appears to still be working fine for me. Are you sure you copied your keys over correctly?

I do see a CB AntiSpam JavaScript error on the forgot login page, but seams to still work for me despite the error since it's just appending an attribute for client side validation. The response code from turnstile also appears to be submitting to your server. So my best guess is "Secret Key" might be incorrect.

Just double checked the keys and they are correct.

I have CORS warnings on each page where Turnstile is used with : Blocked a frame with origin " challenges.cloudflare.com " from accessing a frame with origin " cercle.business ". Protocols, domains, and ports must match.

It seems to block every thing including registration

PS : we already have on the server
add_header Access-Control-Allow-Origin "*";
add_header Timing-Allow-Origin "*";

I can't help you in regards to CORS issues with the iframe as we don't handle that. We simply render the widget and it does whatever Cloudflare needs it to. You'll need to contact Cloudflare regarding that.

I've fixed the JS error in latest CB AntiSpam build, but it was a non-blocking error so unsure if it's going to help with your issue.

Seems to be a bug with cloudflare service for turnstile, so no sure that it's ready usable within CB Antispam

community.cloudflare.com/t/missing-cross-origin-resource-policy-corp-response-header/567311/9

Doesn't appear to be a bug, but something further you need to configure. See the reply below the post you linked. I don't see how this has any impact on CB AntiSpam readiness to using Cloudflare Turnstile as CB AntiSpam isn't responsible for your server configuration. You'll probably run into CORS issues with any external captcha without additional configurations. Have you tried hCaptcha? I've read they have CORS handling out of the box, but have not verified this.