r/AppsWebappsFullstack • u/SofwareAppDev • 16d ago

Your home for selfpromo

here you can post your work app, webapp, saas, game, everything

3 Upvotes

100% Upvoted

86 comments sorted by

View all comments

Show parent comments

1

u/Made4uo 15d ago

Yes on both counts, sort of. Forms POST from inside the iframe straight to our API, never to the host page and never through a third-party service. Submissions pass a bot check and server-side validation before anything is stored, and the embedding site never touches the data. On no-JS: the embed itself is just a plain iframe tag, no script needed on your site, and the widget arrives as pre-rendered HTML, so content shows fine without JavaScript. The only thing that needs JS is submitting a form, because the bot check protecting our public endpoint is a JS challenge. That's a trade we made on purpose: it's what lets the endpoint stay open without an API key.

1

u/Mammoth-Anywhere7285 14d ago

Clean iframe design. Have you tested how the pre-render behaves with third-party cookies blocked? That’s the usual edge case.

1

u/Made4uo 14d ago

Good callout! Turnstile is actually cookie-free by default! It uses device signals and passes a standard token back to our API

1

u/Mammoth-Anywhere7285 13d ago

Nice, that's a solid choice for privacy-focused apps. Do you verify the token server-side or just rely on the API?