Skip to content

fix: handle axios errors in Turnstile service to prevent misleading 5… #1601

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gugu merged 1 commit into from
Feb 16, 2026
Merged

fix: handle axios errors in Turnstile service to prevent misleading 5… #1601

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 15 additions & 9 deletions backend/src/shared/services/turnstile.service.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,15 +29,21 @@ export class TurnstileService {
formData.append('secret', secretKey);
formData.append('response', token);

const response = await axios.post<TurnstileVerifyResponse>(this.verifyUrl, formData.toString(), {
headers: {
'Content-Type': 'application/x-www-form-urlencoded',
},
});

if (!response.data.success) {
const errorCodes = response.data['error-codes']?.join(', ') || 'Unknown error';
throw new BadRequestException(`Turnstile verification failed: ${errorCodes}`);
try {
const response = await axios.post<TurnstileVerifyResponse>(this.verifyUrl, formData.toString(), {
headers: {
'Content-Type': 'application/x-www-form-urlencoded',
},
});

if (!response.data.success) {
const errorCodes = response.data['error-codes']?.join(', ') || 'Unknown error';
throw new BadRequestException(`Turnstile verification failed: ${errorCodes}`);
}
} catch (error) {
if (error instanceof BadRequestException) throw error;
console.error('Turnstile verification error:', error?.response?.data || error?.message || error);
Comment on lines +43 to +45

Copilot AI Feb 16, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The catch block doesn't use axios.isAxiosError() to properly type-check the error before accessing axios-specific properties. This pattern is used elsewhere in the codebase (e.g., table-action-activation.service.ts:199) and provides better type safety. Consider checking if the error is an AxiosError before accessing error.response, or handle non-axios errors differently.

Suggested change
} catch (error) {
if (error instanceof BadRequestException) throw error;
console.error('Turnstile verification error:', error?.response?.data || error?.message || error);
} catch (error: unknown) {
if (error instanceof BadRequestException) throw error;
if (axios.isAxiosError(error)) {
console.error('Turnstile verification error:', error.response?.data || error.message);
} else if (error instanceof Error) {
console.error('Turnstile verification error:', error.message);
} else {
console.error('Turnstile verification error:', error);
}

Copilot uses AI. Check for mistakes.
throw new BadRequestException('Turnstile verification failed. Please try again.');
Comment on lines +43 to +46

Copilot AI Feb 16, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The error message "Turnstile verification failed. Please try again." on line 46 loses valuable context from the original error. When the Cloudflare API returns a specific error (e.g., network issues, timeout, or API-level failures), this generic message makes debugging difficult. Consider including more specific error information in the log or the user-facing message when appropriate.

Suggested change
} catch (error) {
if (error instanceof BadRequestException) throw error;
console.error('Turnstile verification error:', error?.response?.data || error?.message || error);
throw new BadRequestException('Turnstile verification failed. Please try again.');
} catch (error: any) {
if (error instanceof BadRequestException) throw error;
console.error('Turnstile verification error:', error?.response?.data || error?.message || error);
const baseMessage = 'Turnstile verification failed.';
let detailedMessage = '';
if (process.env.NODE_ENV !== 'production') {
const responseData = error?.response?.data;
const errorDetail =
typeof responseData === 'string'
? responseData
: responseData?.['error-codes']?.join(', ') || error?.message;
if (errorDetail) {
detailedMessage = ` Details: ${errorDetail}`;
}
}
throw new BadRequestException(`${baseMessage}${detailedMessage} Please try again.`);

Copilot uses AI. Check for mistakes.
}
Comment on lines +43 to 47

Copilot AI Feb 16, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The new error handling logic introduced in the catch block (lines 43-47) lacks test coverage. Given that this repository has comprehensive automated testing using AVA, consider adding tests to verify that: 1) axios errors are properly caught and re-thrown as BadRequestException, 2) the error is logged with appropriate details, and 3) previously thrown BadRequestExceptions are re-thrown correctly without being wrapped.

Copilot uses AI. Check for mistakes.

return true;
Expand Down
Loading