turnstile · laravel · validation

"The cf-turnstile-response field is required"

This sentence is Laravel's validator, not Cloudflare's. It means the request arrived with no token in it at all — so the failure happened in the browser, before your server was ever asked to judge anything.

What the message is and is not

Laravel produces "The :attribute field is required" for any missing field, and Turnstile packages validate a field named cf-turnstile-response. So this is your own validation rule firing, not a verdict from Cloudflare.

That is useful, because it narrows things sharply. Cloudflare was never consulted. The token was not wrong — it was absent.

If the token had arrived and been bad, you would be looking at a siteverify code such as invalid-input-response instead. Required means empty.

Why the field is empty

CauseHow to confirm it
The widget never renderedView source on the rendered page and look for an element with class cf-turnstile. If it is not there, the component or Blade directive did not output.
The script did not loadCheck the network tab for challenges.cloudflare.com/turnstile/v0/api.js. A content blocker, a strict CSP, or an asset pipeline that defers it will stop the widget existing.
The form submitted before the token arrivedThe widget fills the hidden input asynchronously. A submit fired immediately after page load can beat it. Disable the submit button until the callback runs.
The field is outside the formImplicit rendering inserts the hidden input inside the element it rendered into. If that element sits outside the <form> tag, the browser never serialises it.
The request is AJAX and omits itHand-built payloads include the fields their author remembered. FormData over the whole form includes it automatically; an object literal does not.
A modal or SPA re-render wiped itThe form came back, the widget did not. Nothing repopulates the hidden input, so every attempt after the first submits empty.

Confirm it in the browser before touching the server

One line in the console tells you whether there is a token to send. Run it on the page, after the widget settles, before submitting.

js
document.querySelector('[name="cf-turnstile-response"]')?.value || '(no token)'

// '(no token)'  -> the widget never filled it; the fault is client-side
// '0.Xa3f…'      -> a token exists, so the problem is how the form is submitted

If a token exists but your server still says the field is required, the request is not carrying it — which points at AJAX serialisation or the field sitting outside the form, not at Turnstile.

CSP is the cause people miss

A strict Content-Security-Policy will block the widget's script silently as far as the page is concerned: no visible widget, no token, and a validation error that looks like a form bug. Turnstile needs challenges.cloudflare.com allowed in both script-src and frame-src, because the challenge itself runs in a cross-origin iframe.

The browser console shows a CSP violation when this happens. It is worth checking early, because nothing about the resulting Laravel message hints at it.

Common questions

No. It is Laravel's built-in "field is required" validation message applied to the cf-turnstile-response field. Cloudflare was never contacted — the token was missing from the request, so there was nothing to verify.

Usually timing or re-rendering. A form submitted before the widget's callback has run has no token yet, and a form re-rendered by a modal or a client-side route change comes back without one. Both produce an intermittent failure that is hard to reproduce deliberately.

In the browser console, read the value of the element named cf-turnstile-response. Empty means the widget never filled it and the problem is client-side; a value means the token exists and your submission is not carrying it.

Yes, and it is the cause most often missed. Turnstile needs challenges.cloudflare.com in both script-src and frame-src. If either is absent the script or the challenge iframe is blocked, no token is issued, and the only symptom is this validation message. The console will show the violation.

The exact sentence is Laravel's, but the situation is not framework-specific. Any server that requires the field before checking it produces its own version of the same message, and every cause listed here applies.

No. The field being required is the protection working. Making it optional means accepting submissions with no challenge at all, which removes the reason Turnstile is on the form. Fix why the token is missing instead.

Related

Sources

More in Turnstile errors

Turnstile error 300030Error 300030 means a Turnstile widget mounted and then stopped responding. The real causes, the codes it gets confused with, and the fixes.Turnstile timeout-or-duplicate errorsiteverify returns timeout-or-duplicate when a Turnstile token is verified twice or is older than 300 seconds. The causes, and how to fix each one.Turnstile callback not firingWhy the Turnstile success callback never runs: implicit rendering, callbacks not on window, hidden containers and SPA remounts.Cloudflare Turnstile error 600010Turnstile error 600010 is a generic challenge failure in the 600* family. What Cloudflare documents, the reproduced causes, and how to fix it.cf-turnstile-response invalidThree different failures wear this name. Sort out which one you have — the token never arrived, siteverify refused it, or your keys do not match.Turnstile stuck on "Verifying you are human"Why Turnstile hangs on "Verifying you are human": how to read the error code, plus fixes for CSP, clock skew, blocked domains and headless CI.invalid-input-responsesiteverify returns invalid-input-response when a token is invalid, malformed or expired. The causes worth checking, in the order they occur.invalid-input-secretsiteverify returns invalid-input-secret when your secret key is rejected. Why the key is usually right, and the five things that actually cause it.Token rejected"Token rejected" is not a Cloudflare error — it is what an app prints when siteverify refused its token. What to do, as a visitor or as a developer.

Automating a gate you own or are authorised to test?

// SolveGate clears Cloudflare Turnstile and WAF challenges through one REST call · first 1,000 solves free