行为验证与验证码方案设计

interface LoginPayload {
  username: string;
  password: string;
  captchaToken?: string;
}

async function submitLogin(payload: LoginPayload) {
  return fetch("/api/login", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify(payload),
  });
}

function collectClientSignals() {
  return {
    userAgent: navigator.userAgent,
    language: navigator.language,
    timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
    screen: `${window.screen.width}x${window.screen.height}`,
  };
}

<script
  src="https://challenges.cloudflare.com/turnstile/v0/api.js"
  async defer
></script>

<form id="login-form">
  <input name="username" />
  <input name="password" type="password" />
  <div class="cf-turnstile" data-sitekey="你的站点公钥"></div>
  <button type="submit">登录</button>
</form>

async function validateTurnstileToken(token: string, remoteip?: string) {
  const params = new URLSearchParams();
  params.append("secret", process.env.TURNSTILE_SECRET_KEY || "");
  params.append("response", token);
  if (remoteip) params.append("remoteip", remoteip);

  const response = await fetch(
    "https://challenges.cloudflare.com/turnstile/v0/siteverify",
    { method: "POST", body: params }
  );

  return response.json();
}

function getRiskLevel(action: "login" | "register" | "sms") {
  const riskMap = {
    login: "medium",
    register: "high",
    sms: "very-high",
  } as const;
  return riskMap[action];
}

type VisitEvent = { path: string; timestamp: number };

function isSuspiciousBurst(events: VisitEvent[]) {
  if (events.length < 10) return false;
  const duration = events[events.length - 1].timestamp - events[0].timestamp;
  return duration < 3_000;
}