4 ms·

Cloudflare pops captchas with a 403 for resources in some cases. This can break your site for users. The main document may load, but resources won't. Of course

Cloudflare pops captchas with a 403 for resources in some cases. This can break your site for users. The main document may load, but resources won't. Of course users won't realize this or see the captchas.

onion2k 6y ago
That's quite an extraordinary claim. Surely they don't do that for anything other than requests for the root document of a page, or if the request looks like it's been generated programmatically. That would be incredibly dumb to do that for normal requests for sub-resources on a page. It'd completely break the entire point of using a CDN. Is there any documentation that states this is what happens, or is it only anecdotal?
- ev1 6y ago
  This is unrelated to cdnjs, which shouldn't do that, it "should" just be dumb static hosting with security off. But yes, it absolutely does this for sub resources on a CF hosted site. If you <img src> an image it's entirely likely that the image doesn't load if you pass one CF check and fail another. Why would it? You want people to bypass L7 filters by simply adding a fake referrer or header?
  - aww_dang 6y ago
    If the referrer has a valid cf_captcha url parameter, then they shouldn't be popping captchas for resources.
TekMol 6y ago
Wow, that would be a big one! Where did you see this happen? Do you have a link that backs this up? Why would they ever put a captcha in front of a file served from their cdnjs subdomain?
MattIPv4 6y ago
Hi from cdnjs, This is not something that should be happening, and I've not ever seen any reports of it happening. Do you have any info on exactly when you've seen this happen? This is something we'd definitely like to investigate and resolve if it's happening. - Matt.
- aww_dang 6y ago
  How about on Cloudflare's own help pages? https://pbs.twimg.com/media/EFguS8oU8AEVslR?format=png https://pbs.twimg.com/media/EFguS8oU8AEVslR?format=png https://support.cloudflare.com/hc/en-us/articles/200170136-Why-do-I-see-a-captcha-or-challenge-page-Attention-Required-trying-to-visit-a-site-protected-by-CloudFlare-as-a-site-visitor- https://support.cloudflare.com/hc/en-us/articles/200170136-W... I already reported this. The support person argued the point instead of addressing it. I'm seeing this daily on a Cake affiliate portal. I wouldn't consider using any Cloudflare services for my sites. Instead of filling out captchas, I just skip content hosted by Cloudflare. Not worth my time.
  - TekMol 6y ago
    This seems to be a misunderstanding. You seem to refer to sites served by Cloudfront. My question was about their asset CDN located at cdnjs.cloudflare.com A website might be a target of a DOS attack, so it could make sense to have some heuristics in place to prevent those. An asset CDN is less likely to be attacked since it only hosts static content. And a captcha would not make sense as a signal for this because nobody would see it.
    - aww_dang 6y ago
      Right, nobody sees the captchas for the static CSS files either. I agree that doesn't make any sense. Besides being inconvenient and broken, "doesn't make sense" is synonymous with unpredictable. Hope this helps. You're making a distinction between their services. That's fine, I understand and disagree. As a publisher/developer, I wouldn't be interested for the reasons listed. Aside from that, for most new sites, I remove unused CSS, JS and inline everything into the document. Better pagespeed score this way.

onion2k 6y ago

That's quite an extraordinary claim. Surely they don't do that for anything other than requests for the root document of a page, or if the request looks like it's been generated programmatically. That would be incredibly dumb to do that for normal requests for sub-resources on a page. It'd completely break the entire point of using a CDN. Is there any documentation that states this is what happens, or is it only anecdotal?

ev1 6y ago
This is unrelated to cdnjs, which shouldn't do that, it "should" just be dumb static hosting with security off. But yes, it absolutely does this for sub resources on a CF hosted site. If you <img src> an image it's entirely likely that the image doesn't load if you pass one CF check and fail another. Why would it? You want people to bypass L7 filters by simply adding a fake referrer or header?
- aww_dang 6y ago
  If the referrer has a valid cf_captcha url parameter, then they shouldn't be popping captchas for resources.

TekMol 6y ago

Wow, that would be a big one! Where did you see this happen? Do you have a link that backs this up? Why would they ever put a captcha in front of a file served from their cdnjs subdomain?

MattIPv4 6y ago

Hi from cdnjs, This is not something that should be happening, and I've not ever seen any reports of it happening. Do you have any info on exactly when you've seen this happen? This is something we'd definitely like to investigate and resolve if it's happening. - Matt.

aww_dang 6y ago
How about on Cloudflare's own help pages? https://pbs.twimg.com/media/EFguS8oU8AEVslR?format=png https://pbs.twimg.com/media/EFguS8oU8AEVslR?format=png https://support.cloudflare.com/hc/en-us/articles/200170136-Why-do-I-see-a-captcha-or-challenge-page-Attention-Required-trying-to-visit-a-site-protected-by-CloudFlare-as-a-site-visitor- https://support.cloudflare.com/hc/en-us/articles/200170136-W... I already reported this. The support person argued the point instead of addressing it. I'm seeing this daily on a Cake affiliate portal. I wouldn't consider using any Cloudflare services for my sites. Instead of filling out captchas, I just skip content hosted by Cloudflare. Not worth my time.
- TekMol 6y ago
  This seems to be a misunderstanding. You seem to refer to sites served by Cloudfront. My question was about their asset CDN located at cdnjs.cloudflare.com A website might be a target of a DOS attack, so it could make sense to have some heuristics in place to prevent those. An asset CDN is less likely to be attacked since it only hosts static content. And a captcha would not make sense as a signal for this because nobody would see it.
  - aww_dang 6y ago
    Right, nobody sees the captchas for the static CSS files either. I agree that doesn't make any sense. Besides being inconvenient and broken, "doesn't make sense" is synonymous with unpredictable. Hope this helps. You're making a distinction between their services. That's fine, I understand and disagree. As a publisher/developer, I wouldn't be interested for the reasons listed. Aside from that, for most new sites, I remove unused CSS, JS and inline everything into the document. Better pagespeed score this way.