Skip to content

fix(auth): fix Turnstile captcha blocking all logins #3718

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
waleedlatif1 merged 1 commit into from
Mar 23, 2026
+2 −2
Merged

fix(auth): fix Turnstile captcha blocking all logins #3718

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion apps/sim/app/(auth)/login/login-form.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -472,7 +472,7 @@ export default function LoginPage({
</div>

{turnstileSiteKey && (
<div className='h-0 w-0 overflow-hidden'>
<div className='absolute'>
Copy link
Contributor

@greptile-apps greptile-apps bot Mar 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 absolute without a relative ancestor or positional constraints

The absolute div has no explicit relative positioned parent at the form level (the nearest relative ancestor in the tree is the password input wrapper at line 436). This means the Turnstile wrapper will be positioned relative to whatever positioned ancestor exists further up in the layout tree, which is unpredictable.

For an invisible captcha this is harmless today, but the intent could be made more explicit and defensive by also suppressing pointer events and using overflow-hidden to prevent any edge-case visible challenge from leaking into the layout:

Suggested change
<div className='absolute'>
<div className='absolute overflow-hidden opacity-0 pointer-events-none'>

The same concern applies in signup-form.tsx at line 481.

<Turnstile
ref={turnstileRef}
siteKey={turnstileSiteKey}
Expand Down
2 changes: 1 addition & 1 deletion apps/sim/app/(auth)/signup/signup-form.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -478,7 +478,7 @@ function SignupFormContent({
</div>

{turnstileSiteKey && (
<div className='h-0 w-0 overflow-hidden'>
<div className='absolute'>
<Turnstile
ref={turnstileRef}
siteKey={turnstileSiteKey}
Expand Down
Loading