Call Siteverify and fail closed

The server sends secret and response to the Siteverify endpoint. It may also send the client IP and an idempotency key for safe retry behavior.

Treat network errors and malformed responses as validation failure. Do not process the form first and validate afterward. Keep response details in safe logs while returning a useful generic retry message to the user.

Implement a Worker validation helper and test missing token, invalid token, Siteverify timeout, and successful validation.

Verify the token from trusted server code:

const result = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', {
  method: 'POST',
  body: new URLSearchParams({ secret: env.TURNSTILE_SECRET, response: token })
}).then(response => response.json())

Continue only when success is true and the expected context matches. Reject missing, expired, duplicate, and failed-verification tokens. Apply rate limits and normal authorization after this check.