Unable to sign-up, turnstile not loaded in cors-friendly way

[simonschmidt]

Preliminary Checks

• I have reviewed the documentation: https://clerk.com/docs
• I have searched for existing issues: https://github.com/clerk/javascript/issues
• I have not already reached out to Clerk support via email or Discord (if you have, no need to open an issue here)
• This issue is not a question, general help request, or anything other than a bug report directly related to Clerk. Please ask questions in our Discord community: https://clerk.com/discord.

Reproduction / Replay Link

n/a

Publishable key

n/a

Description

On a site with cross-origin-embedder-policy: require-corp it is not possible to sign-up using email as turnstile fails to load with:

GET https://FRONTEND_API/cloudflare/turnstile/v0/api.js?render=explicit&_clerk_js_version=4.68.1 net::ERR_BLOCKED_BY_RESPONSE.NotSameOriginAfterDefaultedToSameOriginByCoep 200 (OK)

Reproduce

1. Ensure site has cross-origin policy headers set
2. Bring up the sign-in popup, e.g. Clerk.openSignIn()
3. Click "Sign up"
4. Enter valid email address and password
5. Click "Continue"

See error:

Sign up unsuccessful due to failed bot validation. Please refresh the page to try again or reach out to support for more assistance.

Workaround

Manually add a script tag with crossorigin="anonymous" attribute, this works because the captcha loader checks if window.turnstile exists and if so does not try to load it again.

Potential fix

I think it can be fixed by passing in crossOrigin: 'anonymous' in captcha.ts as that should do the same thing as the workaround.

Environment

n/a

[clerk-cookie]

Hello 👋

We currently close issues after 40 days of inactivity. It's been 30 days since the last update here. If we missed this issue, please reply here. Otherwise, we'll close this issue in 10 days.

As a friendly reminder: The best way to see an issue fixed is to open a pull request. If you're not sure how to do that, please check out our contributing guide.

Thanks for being a part of the Clerk community! 🙏

[simonschmidt]

Bump

[jescalan]

So sorry @simonschmidt - something happened with our labeler here that got it messed up. We have this in our backlog and are planning to address!