Users are intermittently unable to log in because the Cloudflare Turnstile verification fails with:
Turnstile verification failed: [timeout-or-duplicate]
The application logs show the failure repeating across subsequent login attempts. An example sequence:
09:17:53 Turnstile verification failed: [timeout-or-duplicate]
09:17:58 Turnstile verification failed: [timeout-or-duplicate]
09:23:25 Invalid credentials
09:23:34 Turnstile verification failed: [timeout-or-duplicate]
Observed behavior
User completes the CAPTCHA and submits the login form.
Login may fail due to invalid credentials or another validation error.
On the next login attempt, the existing Turnstile token appears to be submitted again.
Turnstile rejects it as expired or already used.
The user remains unable to log in without refreshing or reopening the page.
Expected behavior
After every login submission, successful or unsuccessful, the Turnstile widget should reset and generate a new token before another login attempt is allowed.
Likely cause
Turnstile tokens are single-use and expire after a short period. The frontend may be retaining the previous token after a failed login attempt, or the backend may be validating the same token more than once.
Suggested areas to investigate
Reset the Turnstile widget after every login response.
Clear the stored Turnstile token after submission.
Disable the login button while a request is in progress to prevent duplicate submissions.
Confirm the backend only calls Turnstile Siteverify once per login request.
Confirm the token is not being validated in both middleware and the login handler.
Handle Turnstile expiration callbacks by requiring a fresh challenge.
Environment
Browser: Chrome and edge
Endpoint: POST /api/user/login
Error: timeout-or-duplicate
Users are intermittently unable to log in because the Cloudflare Turnstile verification fails with:
Turnstile verification failed: [timeout-or-duplicate]
The application logs show the failure repeating across subsequent login attempts. An example sequence:
09:17:53 Turnstile verification failed: [timeout-or-duplicate]
09:17:58 Turnstile verification failed: [timeout-or-duplicate]
09:23:25 Invalid credentials
09:23:34 Turnstile verification failed: [timeout-or-duplicate]
Observed behavior
User completes the CAPTCHA and submits the login form.
Login may fail due to invalid credentials or another validation error.
On the next login attempt, the existing Turnstile token appears to be submitted again.
Turnstile rejects it as expired or already used.
The user remains unable to log in without refreshing or reopening the page.
Expected behavior
After every login submission, successful or unsuccessful, the Turnstile widget should reset and generate a new token before another login attempt is allowed.
Likely cause
Turnstile tokens are single-use and expire after a short period. The frontend may be retaining the previous token after a failed login attempt, or the backend may be validating the same token more than once.
Suggested areas to investigate
Reset the Turnstile widget after every login response.
Clear the stored Turnstile token after submission.
Disable the login button while a request is in progress to prevent duplicate submissions.
Confirm the backend only calls Turnstile Siteverify once per login request.
Confirm the token is not being validated in both middleware and the login handler.
Handle Turnstile expiration callbacks by requiring a fresh challenge.
Environment
Browser: Chrome and edge
Endpoint: POST /api/user/login
Error: timeout-or-duplicate