Why websites ask “Are you human?”

You can skip this section and still understand the main idea. Developers call the ticket a token and the checking endpoint Siteverify.

The example below checks a token before allowing an action. It is a helper, not a complete form. A real endpoint also needs input limits, spam checks, safe output, and protection against duplicate actions. Keep the secret on the server.

The helper passed 16 local mocked-response tests. That does not certify a production deployment. The learning playground above does not call this helper or Cloudflare.

// Educational validator. Call before storing a submission or performing its action.
// Expected hostname/action must be server-controlled, never copied from a request.
export async function verifyTurnstile(token, secret, expected, fetcher = fetch) {
  if (typeof token !== 'string' || !token || token.length > 2048) {
    return {ok: false, reason: 'verification_required'};
  }
  if (!secret || !expected?.hostname || !expected?.action) {
    return {ok: false, reason: 'verification_unavailable'};
  }
  try {
    const response = await fetcher('https://challenges.cloudflare.com/turnstile/v0/siteverify', {
      method: 'POST',
      headers: {'content-type': 'application/json'},
      body: JSON.stringify({secret, response: token}),
      signal: AbortSignal.timeout(5000)
    });
    if (!response.ok || !response.body) return {ok: false, reason: 'verification_unavailable'};
    const reader = response.body.getReader();
    const decoder = new TextDecoder();
    let body = '', size = 0;
    try {
      for (;;) {
        const part = await reader.read();
        if (part.done) break;
        size += part.value.length;
        if (size > 16384) return {ok: false, reason: 'verification_unavailable'};
        body += decoder.decode(part.value, {stream: true});
      }
    } finally { await reader.cancel(); }
    const result = JSON.parse(body + decoder.decode());
    if (result.success !== true || result.hostname !== expected.hostname || result.action !== expected.action) {
      return {ok: false, reason: 'verification_failed'};
    }
    return {ok: true};
  } catch {
    return {ok: false, reason: 'verification_unavailable'};
  }
}