"The cf-turnstile-response field is required"
This sentence is Laravel's validator, not Cloudflare's. It means the request arrived with no token in it at all — so the failure happened in the browser, before your server was ever asked to judge anything.
What the message is and is not
Laravel produces "The :attribute field is required" for any missing field, and Turnstile packages validate a field named cf-turnstile-response. So this is your own validation rule firing, not a verdict from Cloudflare.
That is useful, because it narrows things sharply. Cloudflare was never consulted. The token was not wrong — it was absent.
If the token had arrived and been bad, you would be looking at a siteverify code such as invalid-input-response instead. Required means empty.
Why the field is empty
| Cause | How to confirm it |
|---|---|
| The widget never rendered | View source on the rendered page and look for an element with class cf-turnstile. If it is not there, the component or Blade directive did not output. |
| The script did not load | Check the network tab for challenges.cloudflare.com/turnstile/v0/api.js. A content blocker, a strict CSP, or an asset pipeline that defers it will stop the widget existing. |
| The form submitted before the token arrived | The widget fills the hidden input asynchronously. A submit fired immediately after page load can beat it. Disable the submit button until the callback runs. |
| The field is outside the form | Implicit rendering inserts the hidden input inside the element it rendered into. If that element sits outside the <form> tag, the browser never serialises it. |
| The request is AJAX and omits it | Hand-built payloads include the fields their author remembered. FormData over the whole form includes it automatically; an object literal does not. |
| A modal or SPA re-render wiped it | The form came back, the widget did not. Nothing repopulates the hidden input, so every attempt after the first submits empty. |
Confirm it in the browser before touching the server
One line in the console tells you whether there is a token to send. Run it on the page, after the widget settles, before submitting.
document.querySelector('[name="cf-turnstile-response"]')?.value || '(no token)' // '(no token)' -> the widget never filled it; the fault is client-side // '0.Xa3f…' -> a token exists, so the problem is how the form is submitted
If a token exists but your server still says the field is required, the request is not carrying it — which points at AJAX serialisation or the field sitting outside the form, not at Turnstile.
CSP is the cause people miss
A strict Content-Security-Policy will block the widget's script silently as far as the page is concerned: no visible widget, no token, and a validation error that looks like a form bug. Turnstile needs challenges.cloudflare.com allowed in both script-src and frame-src, because the challenge itself runs in a cross-origin iframe.
The browser console shows a CSP violation when this happens. It is worth checking early, because nothing about the resulting Laravel message hints at it.
Common questions
No. It is Laravel's built-in "field is required" validation message applied to the cf-turnstile-response field. Cloudflare was never contacted — the token was missing from the request, so there was nothing to verify.
Usually timing or re-rendering. A form submitted before the widget's callback has run has no token yet, and a form re-rendered by a modal or a client-side route change comes back without one. Both produce an intermittent failure that is hard to reproduce deliberately.
In the browser console, read the value of the element named cf-turnstile-response. Empty means the widget never filled it and the problem is client-side; a value means the token exists and your submission is not carrying it.
Yes, and it is the cause most often missed. Turnstile needs challenges.cloudflare.com in both script-src and frame-src. If either is absent the script or the challenge iframe is blocked, no token is issued, and the only symptom is this validation message. The console will show the violation.
The exact sentence is Laravel's, but the situation is not framework-specific. Any server that requires the field before checking it produces its own version of the same message, and every cause listed here applies.
No. The field being required is the protection working. Making it optional means accepting submissions with no challenge at all, which removes the reason Turnstile is on the form. Fix why the token is missing instead.
Related
Sources
More in Turnstile errors
Automating a gate you own or are authorised to test?
// SolveGate clears Cloudflare Turnstile and WAF challenges through one REST call · first 1,000 solves free