Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

When I finish Cloudflare challenge, the captcha.wetsite show me the Privacy Pass homepage and get no tokens #306

Closed
zanderpeng opened this issue Feb 18, 2022 · 25 comments
Closed

When I finish Cloudflare challenge, the captcha.wetsite show me the Privacy Pass homepage and get no tokens #306

zanderpeng opened this issue Feb 18, 2022 · 25 comments

Comments

@zanderpeng
Copy link

operating system： windows 2019
Web browser :chrome 98.0.4758.102
Extension version：3.0.1
Problem description：
When I finish Cloudflare challenge, the captcha.wetsite show me the Privacy Pass homepage and get no tokens
2022-02-18 160256
@RealDolos
Copy link

Can confirm, Chrome and Firefox affected, so it's not a browser-specific problem.
@ppopth you fixed it last time in #291 / #292 and the symptoms now seem identical, except it affects the latest 3.0.1

Diagnosis

QUALIFIED_BODY_PARAMS contains cf_captcha_kind as a required parameter for detection, however that parameter is not actually issued with requests anymore. Thus the extension fails to detect captcha response requests and subsequently fails to convert these requests into token issuance requests and get tokens issued.

Removing the cf_captcha_kind requirement, or replacing it for something that exists, like captcha_answer fixes the problem and makes the extension work again; tokens become available and also are used when needed.
The other checked parameter, h-captcha-response, still exists in the requests and is therefore not a problem for now.

In general, the whole detection code seems to be terribly fragile, if it breaking twice in as many weeks is any indication. It would be good if the cloudflare captcha team could establish a formal way of detecting such requests that the cloudflare privacy pass team could use.

@ppopth ppopth mentioned this issue Feb 19, 2022
Merged
@ppopth
Copy link
Member

ppopth commented Feb 19, 2022

Thank you for reporting. The issue will be solved by #308

@warren-bank
Copy link

warren-bank commented Feb 19, 2022 •
edited
Loading

fwiw, I just retested the most recent release of the extension built from PR #283 ..and it still works correctly (with a few documented caveats). This version was built nearly 3 weeks ago, as the PR hasn't received any recent feedback. Maybe somebody could take a look at its code.. and we could merge some of its many updates?

@zanderpeng
Copy link
Author

I just test version：2.0.7,in this version hcaptcha is work, I get tokens.But Cloudflare still can't work.
By the way，which version is work？ where I can find it for chrome

@tumagonx
Copy link

fwiw, I just retested the most recent release of the extension built from PR #283 ..and it still works correctly (with a few documented caveats ). This version was built nearly 3 weeks ago, as the PR hasn't received any recent feedback. Maybe somebody could take a look at its code.. and we could merge some of its many updates?

Thanks your fork works!
tested version 3.6.6 on Windows XP, Chrome 78, Tor 0.3.5.10

@zanderpeng
Copy link
Author

fwiw, I just retested the most recent release of the extension built from PR #283 ..and it still works correctly (with a few documented caveats ). This version was built nearly 3 weeks ago, as the PR hasn't received any recent feedback. Maybe somebody could take a look at its code.. and we could merge some of its many updates?

Thanks your fork works! tested version 3.6.6 on Windows XP, Chrome 78, Tor 0.3.5.10

when I test 3.6.6 on Windwos 2019 , Chrome 98, it show me this
test

@warren-bank
Copy link

warren-bank commented Feb 20, 2022 •
edited
Loading

@zanderpeng

  • you tried to install a crx2..
    • wrong!
  • recent versions of Chrome only support crx3..
    • please try again using the correct format

I suppose that I should also (preemptively) make the comment that my releases are self-signed.. and not verified by Google or Mozilla. I use SRWare Iron.. which is available in a portable format, and doesn't require extensions to be signed by a marketplace. Firefox dev works too [1]. All other browsers are YMMV.

  • [1] about:config
    • xpinstall.signatures.required = false

@zanderpeng
Copy link
Author

actually,I try both of crx2 and crx3. but they have the same question

@warren-bank
Copy link

warren-bank commented Feb 20, 2022 •
edited
Loading

trying to reproduce..

  • decompressed a fresh copy of Google Chrome 98.0.4758.102 portable
  • chrome://extensions
    • developer mode = false
      • crx3 does not install
      • package is invalid: CRX_REQUIRED_PROOF_MISSING
    • developer mode = true
      • crx3 installs
      • package is permanently disabled because it isn't verified by Google
    • developer mode = true
      • unpacked crx3 installs
      • package is enabled
      • extension is fully functional

conclusions..

  • Chrome: unzip the crx3 into an empty directory, and install the directory as an unpacked extension
  • SRWare Iron: ftw

@tumagonx
Copy link

I use crx2, and since Chrome (360 EE) is run as Guest user, all of my extensions are in developer mode.

@warren-bank
Copy link

according to this Chrome changelog, version 73.0.3683 is when Chrome ended support for installing crx2 extensions; this and all subsequent versions of Chrome only allow crx3.

@warren-bank
Copy link

I'm back to using SRWare Iron 85 now.. and just tried to install the crx2;
it refuses with the error: CRX_HEADER_INVALID
..which basically just means that it requires a crx3 instead.

@tumagonx
Copy link

oops sorry I have 2 chrome 69 and 78, this one us 69 :D
Untitled

@warren-bank
Copy link

warren-bank commented Feb 20, 2022 •
edited
Loading

fun fact..

since the crx2 extension is expected to be used in older browsers,
which will be using a javascript engine that doesn't support all modern language features;
the crx2 extensions that I release:

  • are fully converted to ES5
  • include the core-js polyfill library

I've successfully tested it in Chrome v30:

  • hCaptcha works perfectly
  • Cloudflare's website doesn't work in this browser,
    but the extension appears to be fully functional

@warren-bank
Copy link

another fun fact..

all of the text presented in the extension's UI has been setup for internationalization.

atm, I've only included english..
but translations will be very easy to add later.

@ppopth ppopth closed this as completed Feb 23, 2022
@tumagonx
Copy link

is this happen again? please reopen
I tried like 10 times solving the puzzle, never got cloudflare token, hcaptcha works.

@warren-bank
Copy link

observations:

  • yep, I can confirm that the Cloudflare provider has (yet again) made breaking changes
  • in Chrome devtools, inspecting the network tab for the background page:
    • the extension is still correctly:
      • detecting and intercepting the correct request
      • sending its own request for Cloudflare to sign tokens
    • the Cloudflare backend is now incorrectly:
      • responding to the extension's request with a 403 status code
        • the content of the response is the HTML page that is seen in the browser,
        • rather than a JSON data structure containing signed tokens

status:

  • in the month since this issue was closed:
    • my fork has received no feedback or any attempt to merge any changes
    • aside from adding string translations, I haven't made any farther changes
  • I'm not eager to devote much additional effort to my fork, because:
    • this project isn't being actively maintained
    • contributions are largely ignored
    • the captcha providers are constantly making changes without any apparent coordination with this project
      • which makes its foundation very unstable

@tumagonx
Copy link

dang that sounds like legitimate way of cloudflare try kills tor users like me (not a bot!),
I wonder how other tor users survive this blatant internet censorship considering most website use cloudflare services. And here i am trying to escape government censorship (reddit blocked) only to get toyed by cloudflare.
No way I'll use expensive VPN service though.

@ppopth ppopth reopened this Mar 20, 2022
@ppopth
Copy link
Member

ppopth commented Mar 20, 2022 •
edited
Loading

@tumagonx Yes, we made a change on the backend, but it should have been solved in #308 and it was released with v3.0.2
If you haven't updated the version to v3.0.2, please do so. Then, if the issue still exists, we will investigate on that.
Thank you

@warren-bank
Copy link

@tumagonx I'll push an update.. I imagine it should be a trivial fix to rejigger the request parameters to compensate for whatever change was recently made on the backend. I'll look at it later tonight.

@warren-bank
Copy link

@tumagonx fwiw, v3.7.2 issues Cloudflare tokens again. A querystring parameter in the request to issue CF tokens was renamed.

@tumagonx
Copy link

@warren-bank you save the day, I'll try learn the changes in case of another breaks happen.

@aravindvnair99
Copy link

aravindvnair99 commented Apr 3, 2022 •
edited
Loading

@tumagonx Yes, we made a change on the backend, but it should have been solved in #308 and it was released with v3.0.2
If you haven't updated the version to v3.0.2, please do so. Then, if the issue still exists, we will investigate on that.
Thank you

@ppopth The issue continues in version 3.0.2 of the extension as well. I get Cloudflare but not hCaptcha.

image

Google Chrome 100.0.4896.60 (Official Build) (64-bit) (cohort: Stable Installs & Version Pins)
OS Windows 11 Version 21H2 (Build 22000.593)

Related / similar open issues:

This was referenced Apr 3, 2022
Closed
Closed
Closed
@armfazh
Copy link
Member

armfazh commented Nov 14, 2022

@zanderpeng try the new version v3.0.4, and open a new ticket if you had a new issue.

@armfazh armfazh closed this as completed Nov 14, 2022
@Deyrap355
Copy link

Deyrap355 commented Nov 16, 2022 via email

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
8 participants
@ppopth @tumagonx @warren-bank @RealDolos @armfazh @aravindvnair99 @zanderpeng @Deyrap355