From ffeb1b24ef85ee98c048649a554136f9fe9d43cf Mon Sep 17 00:00:00 2001
From: Wod <102715297+thiswod@users.noreply.github.com>
Date: Tue, 11 Aug 2026 13:55:01 +0800
Subject: [PATCH] fix(web): refresh Turnstile token after login attempt (#6764)

Co-authored-by: multica-agent <github@multica.ai>
---
 .../auth/sign-in/components/user-auth-form.tsx        | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/web/src/features/auth/sign-in/components/user-auth-form.tsx b/web/src/features/auth/sign-in/components/user-auth-form.tsx
index 39d41a6b..cbd61a7b 100644
--- a/web/src/features/auth/sign-in/components/user-auth-form.tsx
+++ b/web/src/features/auth/sign-in/components/user-auth-form.tsx
@@ -72,6 +72,7 @@ export function UserAuthForm({
   const [isPasskeyLoading, setIsPasskeyLoading] = useState(false)
   const [isWeChatDialogOpen, setIsWeChatDialogOpen] = useState(false)
   const [isWeChatSubmitting, setIsWeChatSubmitting] = useState(false)
+  const [turnstileWidgetKey, setTurnstileWidgetKey] = useState(0)
   const legalConsentErrorMessage = t('Please agree to the legal terms first')
   const loginFailedMessage = t('Login failed')
 
@@ -158,12 +159,18 @@ export function UserAuthForm({
 
     if (!validateTurnstile()) return
 
+    const submittedTurnstileToken = turnstileToken
+    if (isTurnstileEnabled) {
+      setTurnstileToken('')
+      setTurnstileWidgetKey((current) => current + 1)
+    }
+
     setIsLoading(true)
     try {
       const res = await login({
         username: data.username,
         password: data.password,
-        turnstile: turnstileToken,
+        turnstile: submittedTurnstileToken,
       })
 
       if (res.success) {
@@ -408,8 +415,10 @@ export function UserAuthForm({
             {isTurnstileEnabled && (
               <div className='mt-2'>
                 <Turnstile
+                  key={turnstileWidgetKey}
                   siteKey={turnstileSiteKey}
                   onVerify={setTurnstileToken}
+                  onExpire={() => setTurnstileToken('')}
                 />
               </div>
             )}