Validate Turnstile at the form endpoint before performing the protected action

The visible widget is not the server’s authorization to accept a submission.

Source facts

Cloudflare states that Turnstile requires server-side Siteverify validation; a client widget alone does not protect a form. Tokens expire after five minutes and can be validated only once. Reuse or expiry produces timeout-or-duplicate, and the page documents an idempotency key for safely retrying a validation request.

Source: Cloudflare — Validate the token.

Applicability

This concerns a Turnstile-protected server action.

DSE recommendation

DSE recommends placing validation before email delivery, record creation, or another protected side effect. Handle missing, expired, duplicate, and failed verification explicitly while preserving a useful retry experience for legitimate users. Keep the secret on the server and restrict diagnostics to safe result metadata. Separate verification retries from action retries so a network failure does not cause duplicate messages or records after a successful submission. Give each failure path an explicit side-effect expectation: no email, no record, or the corresponding protected action. Ask the application owner to inspect that result directly in the pilot. Keep challenge refresh separate from submitting the action again so retry guidance does not invite duplicate work.

Verification

In a nonproduction workflow, test a valid token, an omitted token, an expired token, and replay of a previously used token. Confirm rejected requests do not perform the protected action. Simulate a verification timeout and inspect retry handling, then verify that a legitimate user can refresh the challenge and complete one intended submission.

Official reference

Cloudflare — Validate the token. Reviewed October 20, 2026.