Browser is blocked by Akamai and Cloudflare

Bug Reports
#52

I tested https://www.k-ruoka.fi today, the site also use Cloudflare, strangely only the mobile site was affected.

To use I’ve used EMBED_CONSOLE=1 sailfish-browser as described in the Sailfish OS docs down below:

In this sites case the cloudflare JavaScript doesn’t load:

CONSOLE message:
[JavaScript Warning: "Cookie “cf_chl_2” will be soon rejected because it has the “sameSite” attribute set to “none” or an invalid value, without the “secure” attribute. To know more about the “sameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite" {file: "https://www.k-ruoka.fi/cdn-cgi/challenge-platform/h/g/orchestrate/managed/v1?ray=781eb6ec5bdcd90a" line: 1}]
CONSOLE message:
[JavaScript Warning: "Cookie “cf_chl_2” will be soon rejected because it has the “sameSite” attribute set to “none” or an invalid value, without the “secure” attribute. To know more about the “sameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite" {file: "https://www.k-ruoka.fi/cdn-cgi/challenge-platform/h/g/orchestrate/managed/v1?ray=781eb6ec5bdcd90a" line: 1}]
CONSOLE message:
[JavaScript Warning: "The ‘content’ attribute of Window objects is deprecated.  Please use ‘window.top’ instead." {file: "https://www.k-ruoka.fi/cdn-cgi/challenge-platform/h/g/orchestrate/managed/v1?ray=781eb6ec5bdcd90a line 1 > Function" line: 3}]
CONSOLE message:
[JavaScript Warning: "onmozfullscreenchange is deprecated." {file: "https://www.k-ruoka.fi/cdn-cgi/challenge-platform/h/g/orchestrate/managed/v1?ray=781eb6ec5bdcd90a line 1 > Function" line: 3}]
CONSOLE message:
[JavaScript Warning: "onmozfullscreenerror is deprecated." {file: "https://www.k-ruoka.fi/cdn-cgi/challenge-platform/h/g/orchestrate/managed/v1?ray=781eb6ec5bdcd90a line 1 > Function" line: 3}]
CONSOLE message:
[JavaScript Error: "Security Error: Content at https://www.k-ruoka.fi/kauppa/tuote/voner-jouluvarras-400g-viipaloitu-6430069071019 may not load data from https://kkc6w.cloudflarecaptcha.com/."]
CONSOLE message:
[JavaScript Warning: "The ‘content’ attribute of Window objects is deprecated.  Please use ‘window.top’ instead." {file: "https://www.k-ruoka.fi/cdn-cgi/challenge-platform/h/g/orchestrate/managed/v1?ray=781eb6ec5bdcd90a line 1 > Function" line: 3}]
CONSOLE message:
[JavaScript Warning: "onmozfullscreenchange is deprecated." {file: "https://www.k-ruoka.fi/cdn-cgi/challenge-platform/h/g/orchestrate/managed/v1?ray=781eb6ec5bdcd90a line 1 > Function" line: 3}]
CONSOLE message:
[JavaScript Warning: "onmozfullscreenerror is deprecated." {file: "https://www.k-ruoka.fi/cdn-cgi/challenge-platform/h/g/orchestrate/managed/v1?ray=781eb6ec5bdcd90a line 1 > Function" line: 3}]
CONSOLE message:
[JavaScript Warning: "Cookie “cf_chl_cc_nJMrJAgIdwKE” will be soon rejected because it has the “sameSite” attribute set to “none” or an invalid value, without the “secure” attribute. To know more about the “sameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite" {file: "https://www.k-ruoka.fi/cdn-cgi/challenge-platform/h/g/orchestrate/managed/v1?ray=781eb6ec5bdcd90a line 1 > Function" line: 3}]
CONSOLE message:
[JavaScript Warning: "Cookie “cf_chl_cc_UKSqaIhqArCU” will be soon rejected because it has the “sameSite” attribute set to “none” or an invalid value, without the “secure” attribute. To know more about the “sameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite" {file: "https://www.k-ruoka.fi/cdn-cgi/challenge-platform/h/g/orchestrate/managed/v1?ray=781eb6ec5bdcd90a line 1 > Function" line: 3}]
CONSOLE message:
[JavaScript Warning: "Cookie “cf_chl_cc_nJMrJAgIdwKE” will be soon rejected because it has the “sameSite” attribute set to “none” or an invalid value, without the “secure” attribute. To know more about the “sameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite" {file: "https://www.k-ruoka.fi/cdn-cgi/challenge-platform/h/g/orchestrate/managed/v1?ray=781eb6ec5bdcd90a line 1 > Function" line: 3}]
CONSOLE message:
[JavaScript Warning: "Cookie “cf_chl_cc_UKSqaIhqArCU” will be soon rejected because it has the “sameSite” attribute set to “none” or an invalid value, without the “secure” attribute. To know more about the “sameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite" {file: "https://www.k-ruoka.fi/cdn-cgi/challenge-platform/h/g/orchestrate/managed/v1?ray=781eb6ec5bdcd90a line 1 > Function" line: 3}]
CONSOLE message:
[JavaScript Warning: "Cookie “cf_chl_rc_m” will be soon rejected because it has the “sameSite” attribute set to “none” or an invalid value, without the “secure” attribute. To know more about the “sameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite" {file: "https://www.k-ruoka.fi/cdn-cgi/challenge-platform/h/g/orchestrate/managed/v1?ray=781eb6ec5bdcd90a line 1 > Function" line: 3}]

The JavaScript check not loading properly cloud be also why other sides don’t work.

3 Likes
#53

nettiauto.fi has had similar issues for me, it loads the captcha but only after a really looong time. From the above logs, cross-site problems / aka client side security “too strong” for cloudflare?
curl will only help one request at the time ( and give clues on UA and http level)

#54

Just ran a few tests against gigantti.fi myself.

  1. My usual setup: Works without problems, but my Jolla is behind an ad-blocking DNS (similar to Pi-Hole DNS).
  2. Switched to some public DNS (9.9.9.9): Access Denied. Apparentently some ad-provider included in the site and blocked by my DNS triggers the problems.
  3. Switched back to my DNS: Still no access. Hence information about access must be persistently stored.
  4. Deleted most cookies: Site is back to normal.
2 Likes
#55

Interesting… I still have a blunt Acess denied from Cloudfare on http://bank.varomoney.com/signup

#56

I see the problem on several ecommerce sites. The example I definitely remember and can replicate is the US overstock retailer Sierra Trading Post: www.sierra.com. As soon as I search for a product, I get the “Access Denied You don’t have permission to access http://www.sierra.com/…”

#57

Browser still blocked by cloudflare on 4.5.0.19!

#58

Also on 4.5.0.21 !
20chars

#59

Probably OT, but I downloaded and installed this app because I am very interested in weather.
All I got out of that was heavily reminded why I do not use android apps, except from the mandatory banking shit. :unamused:

2 Likes
#60

Yeah, I’m using the API which strips all the bull :slight_smile: I hadn’t actually tried the android app, but just the web app and the APIs.

1 Like
#61

I’ve reached out to Adam Martinetti from Cloudflare (PM of challenge platform) as he was offering his help in a recent HN thread to firefox users that get endless challenge. Did get a reply (yay) and he’s optimistic as they managed to get waterfox users’ issues fixed, the only problem is I don’t think there is a way for us to get a HAR file from our browser when it fails a challenge (gets into endless loop), I did send him logs from gitlab user login, but not sure if that has all the info that a HAR would. Does anybody know how to get our browser to generate HAR file? Any Jolla devs maybe have a secret build with dev tools enabled (and a secret right-click option too I guess)?

9 Likes
#62

One can build the browser with debug enabled or something like that, there are instructions on the github repo for that

#63

Debug will most likely just contain symbols for debugging crashes with gdb, dev tools I’m assuming requires even more newer packages than standard build and as it’s practically unusable on mobile (no right click etc) and would add to memory consumption is probably skipped, but maybe someone out there built with the dev tools included?

#64

Hmm… made me think… it would be nice if devtools.debugger.remote-enabled about:config preference would work… Newer Firefox browsers have a GUI option for this.
I havent been able to see an open listening port for this option though. It might require some ssh forwarding if you figure out an option that works.

1 Like
#65

Just my two cents, but I’m not at all experiencing this issue on Cloudflare sites using the SFOs browser in the latest 4.5. I’m not disputing browser improvement is needed, but it may be more than just the browser leading to some being classified as inadmissible or getting trapped in verification loops. I do sometimes have trouble with Cloudflare if I’m on a VPN such as nordvpn- but changing browsers in those cases (my alt is Brave under AlienDavlik) has never solved that.

#66

So yeah, this is not going anywhere, he sent the logs to his engineers and they claim they do not contain the information they need (30 seconds of few challenges failed generated 20Mb so doubt, just their automated tools are probably custom made for HAR files and no engineer is going to bust his ass to parse all that data, pretty sure nsHttp:5 logging level has everything HAR files have and much more). Apparently their challenge platform has problems with privacy focused browsers that override ‘referer’ headers, but pretty sure sfos browser doesn’t do this and it was enough to grep the log file for ‘referer’ to see that this data was of course there and looks pretty much the same as what you get from desktop firefox. Looks like the only way is to inform platforms that use cloudflare they are blocking real customers and losing potential business (if you have a project on gitlab let them know I guess, maybe they can dial down their WAF to 9 instead of 11 as cloudflare is unlikely to change this)

4 Likes
#67

So you managed to get har files from sailfishos-browser? How?

#68

It is pretty odd that they want client-side logging for something like this.
When i almost got a response, they just wanted the id string thingy from the error.
But their useless forum closes everything automatically after two weeks, so no follow-ups were possible.

BTW: can the emulator run the browser, so they may be able to self-serve in pointing it against somewhere they have extra logs enabled?

#69

No, just logging from about:networking, if you enable all modules it generates tens of megabytes per minute, har files contain pretty much what nsHttp module logs about requests (headers (size), cookies, url, querystring, content), the module throws pretty much everything at level 5 for debugging so it’s all there just not in json

3 Likes
#70

Yeah on HN he was just asking for Ray ID (that’s listed on the bottom of the page) and seeing how many responses he got their product still has tons of false positives (weirdly enough a lot of FF forks affected, then again they also broke all 4chan apps when they started requiring higher android webview version all of a sudden so it’s not only FF users that get to feel quality of their work)

1 Like
#71

Thanks for sharing and for trying to reach out to them about this problem.

1 Like