Cloudflare Verification Loop issues

Users and developers helping users with generic and technical Pale Moon issues on all operating systems.

Moderator: trava90

Forum rules
This board is for technical/general usage questions and troubleshooting for the Pale Moon browser only.
Technical issues and questions not related to the Pale Moon browser should be posted in other boards!
Please keep off-topic and general discussion out of this board, thank you!
User avatar
cannonmc
Fanatic
Fanatic
Posts: 115
Joined: 2018-08-22, 22:46

Re: Cloudflare Verification Loop issues

Unread post by cannonmc » 2025-02-28, 01:37

Win7 PM33.6
looks like the end of palemoon. ... time to abandon pm for a lil while
Why?

It works as a browser is meant to on every other site out of dozens I have bookmarked. It doesn't want to divert me to its own preferences. I can happily access world sites such as BBC or CNN or my local chat group.

In recent days I have tried all the browsers CF 'recommends' and they are all flawed. From Chrome installing with no options and making itself default browser to simple things like not being able to move the direction arrows to r/h side. Even not changing focus to new page. Why else would you click on a tab.

I keep one alternate browser for the very few sites I visit that are blocked by CF. Meanwhile I will stick wiith PM

User avatar
cartel
Astronaut
Astronaut
Posts: 504
Joined: 2014-03-16, 21:57
Location: Chilliwack, BC

Re: Cloudflare Verification Loop issues

Unread post by cartel » 2025-02-28, 01:38

xlolitadabananax wrote:
2025-02-28, 01:16
looks like the end of palemoon. i even tried to paste cookies files from firefox to palemoon & after a certain period, it turns the logged state to logged off. & also tried to force cloudfare to open simple profiles. time to abandon pm for a lil while & if no serious fix is found, ill eventually uninstall it for good. cause retarded cloudfare won in messing up with systems & ppl, & i dont have time to waste on this endlessly.
I'm just gonna stop visiting sites with cloudflare. something critical I will use chrome, like summit racing but all the rest can gfts
ImageImage

BenFenner
Keeps coming back
Keeps coming back
Posts: 824
Joined: 2015-06-01, 12:52
Location: US Southeast

Re: Cloudflare Verification Loop issues

Unread post by BenFenner » 2025-02-28, 02:21

Off-topic:
cartel wrote:
2025-02-28, 01:38
I'm just gonna stop visiting sites with cloudflare
It's been a month now and I've not run across a single site using Cloudflare in my travels. Of course YMMV but from where I sit every site I've used has made the smart choice to avoid using the utter trash MITM that is Cloudflare.

User avatar
Mæstro
Astronaut
Astronaut
Posts: 552
Joined: 2019-08-13, 00:30
Location: Casumia

Re: Cloudflare Verification Loop issues

Unread post by Mæstro » 2025-02-28, 04:26

It might be helpful to observe that Ungoogled Chromium (v104·0·5112·101) suffers similar looping as Pale Moon. Cloudflare behaves as it ought in Epiphany 3·32·1·2 at the time of writing.
Browser: Pale Moon (official build, updated regularly)
Operating System: Linux Mint Debian Edition 4 (amd64)
※Receiving Debian 10 ELTS security upgrades
Hardware: HP Pavilion DV6-7010 (1400 MHz, 6 GB)
Ash is the best letter.

User avatar
jobbautista9
Keeps coming back
Keeps coming back
Posts: 957
Joined: 2020-11-03, 06:47
Location: Philippines

Re: Cloudflare Verification Loop issues

Unread post by jobbautista9 » 2025-02-28, 05:13

Mæstro wrote:
2025-02-28, 04:26
Ungoogled Chromium (v104·0·5112·101)
That Chromium version is from August 2022. You probably should upgrade that as the latest right now is 133.0.6943.141. :think:
Image

"Destroying things, smartly!" - IJN Samidare, probably

Avatar artwork by ebifurya: https://www.pixiv.net/artworks/85379109

XUL add-ons developer. You can find a list of add-ons I manage at http://rw.rs/~job/software.html.

User avatar
Bryn89
Moongazer
Moongazer
Posts: 8
Joined: 2024-12-08, 18:57
Location: Glasgow, Scotland, UK

Re: Cloudflare Verification Loop issues

Unread post by Bryn89 » 2025-02-28, 10:00

I've just updated my version of Pale Moon, and I still run into an issue with one site that uses CloudFlare (regarding "random timeouts" whenever I browse around it), and with this being the same for Firefox too. For CloudFlare to do this to us people that don't wish to use Chrome or Edge like everybody else is just unacceptable... I hope to see more fixes on this in the next release, if possible that is.
https://mindsconnected.tech
Small tech forum for all...

User avatar
Mike_Walsh
Moonbather
Moonbather
Posts: 72
Joined: 2019-09-14, 20:09
Location: King's Lynn, UK

Re: Cloudflare Verification Loop issues

Unread post by Mike_Walsh » 2025-02-28, 12:06

cartel wrote:
2025-02-28, 01:38
xlolitadabananax wrote:
2025-02-28, 01:16
looks like the end of palemoon. i even tried to paste cookies files from firefox to palemoon & after a certain period, it turns the logged state to logged off. & also tried to force cloudfare to open simple profiles. time to abandon pm for a lil while & if no serious fix is found, ill eventually uninstall it for good. cause retarded cloudfare won in messing up with systems & ppl, & i dont have time to waste on this endlessly.
I'm just gonna stop visiting sites with cloudflare. something critical I will use chrome, like summit racing but all the rest can gfts
Not all of us have that choice.

I moderate on two sites; the Puppy Linux discussion forum, and BleepingComputer. The Puppy Forum has never used CF, but BC - a huge site, with over a million registered users, of which perhaps 150,000 are regularly active - had to implement CF due to to accelerated spam activity ever since the start of COVID-19. The stuff was literally flooding in faster than a team of 10 of us could deal with it.

As a staff member, I have to be able to access the site daily. I love Pale Moon, but now cannot use it for BC staff duties.....which means having to use one of the "officially-sanctioned" browsers. This isn't a problem for me, as I have at least a dozen browsers on the system at any one time, due to packaging/testing/maintaining a whole bunch of 'portable' browser builds for the community, but....

.....it's STILL frickin' annoying!

(*shrug...)

Mike. :o :roll:
Puppy "stuff" ~ MORE Puppy "stuff" ~ ....and MORE! :D
_______________________________________________________

Image

BenFenner
Keeps coming back
Keeps coming back
Posts: 824
Joined: 2015-06-01, 12:52
Location: US Southeast

Re: Cloudflare Verification Loop issues

Unread post by BenFenner » 2025-02-28, 14:04

Mike_Walsh wrote:
2025-02-28, 12:06
[BleepingComputer] had to implement CF due to to accelerated spam activity
Yet, somehow Meta (Facebook, IG, etc.) and Alphabet (Google, YouTube, etc.) and a million others more active and juicy manage without it. :roll:

User avatar
BopBe
Hobby Astronomer
Hobby Astronomer
Posts: 28
Joined: 2019-08-21, 19:59

Re: Cloudflare Verification Loop issues

Unread post by BopBe » 2025-02-28, 15:43

BenFenner wrote:
2025-02-28, 14:04
Mike_Walsh wrote:
2025-02-28, 12:06
[BleepingComputer] had to implement CF due to to accelerated spam activity
Yet, somehow Meta (Facebook, IG, etc.) and Alphabet (Google, YouTube, etc.) and a million others more active and juicy manage without it. :roll:
Are you seriously comparing the computing capacity of some of the largest datacenter operators on Earth to bleepingcomputer?

User avatar
Moonchild
Pale Moon guru
Pale Moon guru
Posts: 37762
Joined: 2011-08-28, 17:27
Location: Motala, SE

Re: Cloudflare Verification Loop issues

Unread post by Moonchild » 2025-02-28, 18:44

Mike_Walsh wrote:
2025-02-28, 12:06
BC - a huge site, with over a million registered users, of which perhaps 150,000 are regularly active - had to implement CF due to to accelerated spam activity ever since the start of COVID-19.
The thing is, you don't have to have bot detection enabled in the way that impacts Pale Moon and other independent browsers. You can still use CF and their other features (for now, anyway) that would keep most of that traffic at bay. I know, because that's what I did when I was their client - pretty sure nobody on legit browsers saw a CF captcha or turnstile page on the palemoon.org domain.
"A dead end street is a place to turn around and go into a new direction" - Anonymous
"Seek wisdom, not knowledge. Knowledge is of the past; wisdom is of the future." -- Native American proverb
"Linux makes everything difficult." -- Lyceus Anubite

User avatar
flamelord
Moonbather
Moonbather
Posts: 57
Joined: 2025-01-31, 03:03

Re: Cloudflare Verification Loop issues

Unread post by flamelord » 2025-02-28, 19:08

Science.org seems to get through the cloudflare
Didn't even give me a tickbox it just verified and I was able to use the site
I guess that site fixed it themselves

User avatar
Moonchild
Pale Moon guru
Pale Moon guru
Posts: 37762
Joined: 2011-08-28, 17:27
Location: Motala, SE

Re: Cloudflare Verification Loop issues

Unread post by Moonchild » 2025-02-28, 20:28

flamelord wrote:
2025-02-28, 19:08
Science.org seems to get through the cloudflare
Didn't even give me a tickbox it just verified and I was able to use the site
I guess that site fixed it themselves
looks like it.
By the way, if you have challenges.cloudflare.com blocked on it, it will just inform you to unblock it, and when you do, it proceeds without issue.
"A dead end street is a place to turn around and go into a new direction" - Anonymous
"Seek wisdom, not knowledge. Knowledge is of the past; wisdom is of the future." -- Native American proverb
"Linux makes everything difficult." -- Lyceus Anubite

User avatar
flamelord
Moonbather
Moonbather
Posts: 57
Joined: 2025-01-31, 03:03

Re: Cloudflare Verification Loop issues

Unread post by flamelord » 2025-02-28, 23:14

Moonchild wrote:
2025-02-28, 20:28
flamelord wrote:
2025-02-28, 19:08
Science.org seems to get through the cloudflare
Didn't even give me a tickbox it just verified and I was able to use the site
I guess that site fixed it themselves
looks like it.
By the way, if you have challenges.cloudflare.com blocked on it, it will just inform you to unblock it, and when you do, it proceeds without issue.
So it seems like many sites with cloudflare are working now, however the ones with the turnstile with the tickbox like 4chan still aren't working.
I think it's likely that science.org didn't fix it but CF fixed it some degree but it seems not fully yet. At last that is what I'm guessing here.

User avatar
Mike_Walsh
Moonbather
Moonbather
Posts: 72
Joined: 2019-09-14, 20:09
Location: King's Lynn, UK

Re: Cloudflare Verification Loop issues

Unread post by Mike_Walsh » 2025-03-01, 05:10

BopBe wrote:
2025-02-28, 15:43
Are you seriously comparing the computing capacity of some of the largest datacenter operators on Earth to bleepingcomputer?
Personally, I'm not "comparing" anything at all. I'm merely relating the facts as they affect me, personally.

Don't interpret the fact of my being "staff" to mean that I, personally, am in any kind of position to do anything about the situation as it stands. In that respect, I'm simply a BC member, like everybody else there is. Even our Admin - a Scot, Chris Cosworth - is somewhat limited in what he can & can't do.
Moonchild wrote:
2025-02-28, 18:44
The thing is, you don't have to have bot detection enabled in the way that impacts Pale Moon and other independent browsers. You can still use CF and their other features (for now, anyway) that would keep most of that traffic at bay. I know, because that's what I did when I was their client - pretty sure nobody on legit browsers saw a CF captcha or turnstile page on the palemoon.org domain.
Oh, I agree with you completely, Moonchild. The fact of my being the sole Linux-only mod on what is primarily a Windows trouble-shooting site tends to mean that my concerns go largely unheeded.....a "lone voice crying in the wilderness", as it were. Everybody else there is running Windows 10 or 11 and using almost exclusively Chromium-based browsers, so as far as I'm aware the "problem" hasn't even been mentioned on the site.

If I were to heed the "advice" of some of our other members here I would simply close my BC a/c forthwith and say "F**k you" to the community. Yet I've been there for almost 9 years now, and have a very good relationship with the rest of the staff AND with many ordinary members, so.....I confess, I'm rather loathe to rock the boat.

To date, my concerns have so far been shared with the rest of the staff in what's called the "Moderators Lounge" area. Hmm.... I think I'll start a thread there in the public "Off-topic" area, and see if any other members have encountered the issue as it affects those of us who prefer using "non-mainstream" browsers. I'm quite sure I can't be the only one, and indeed, for the majority who've not encountered the issue, they're probably not even aware there IS one.

Yah; I think that's the best course of action. I can but try, so I'll keep y'all posted as to what transpires.


Mike. :|
Puppy "stuff" ~ MORE Puppy "stuff" ~ ....and MORE! :D
_______________________________________________________

Image

User avatar
LuftWafflePilot
Lunatic
Lunatic
Posts: 309
Joined: 2021-02-19, 20:46

Re: Cloudflare Verification Loop issues

Unread post by LuftWafflePilot » 2025-03-01, 12:37

Can anyone write a very short explanation of the problem and possible solution I can copypaste and send to any website's contact address that currently doesn't work in PM because of this?
Right now SteamDB is one of those that really annoy me.

User avatar
stefan11111
Apollo supporter
Apollo supporter
Posts: 49
Joined: 2023-08-13, 18:09

Re: Cloudflare Verification Loop issues

Unread post by stefan11111 » 2025-03-01, 16:36

Beware, this is a rant.

It's been a month, or however long it's been since cloudflare websites stopped working.
It seems to me like palemoon is taking a beating and it's devs notice it, but do nothing about it.
The fact that palemoon can't access part of the web does not affect cloudflare in any way.
If we don't do something about it, we're at the mercy of cloudflare, and it seems like they won't fix this.

Sadly, I don't have any web and javascript knowledge to help with patches.
If I could have fixed this, I would have at least tried.

I have 3 ideas that might both not work for whatever reason, but at least they seem reasonable:

1. Implement whatever missing javascript functionality is missing that cloudflare needs.
If you don't know what to implement, maybe ask cloudflare and other browser devs what is needed.

2. Add hacks to circumvent the captcha.
If implementing the proper functionality is too hard, maybe just add enough to make cloudflare happy, even if all other js code using that feature would fail.
Or add whatever hack is needed to circumvent cloudflare, if there is something else that can be done.

3. Switch to the v8 js engine.
This is the most extreme change, but it would fix the cloudflare problem and any other problem with javascript forever.
It might even be easier long term, because then the palemoon devs would no longer need to maintain their js engine, as someone else is already maintaining it for them.

Hopefully I'm wrong about all this, and there is a lot of work on fixing the cloudflare issue going on behind the scenes,
but as I see it, the palemoon devs are sitting on their asses and users are doing more to fix this that the devs.

Some users created an extension to circumvent cloudflare by adding cookies from other browsers. This is far from ideal, but at least it's an attempt.
All I see from the devs, especially moonchild, is them throwing their hands up in the air and saying "we can't do anything, and we shouldn't even be doing anything to fix this".
While they are right in saying that they shouldn't have to deal with this, it's like telling a robber that legally they can't rob you - you will still get robbed.

If the devs don't like reading this, think about it from the point of view of a user.
The last good browser with xul extension support is being killed and those who can do something about it sit idly.
The alternatives are the bloated mess that is chromium or something firefox-based.
I'll pick librewolf to switch to, as that is what I used before switching to palemoon, unless I find something better.
But librewolf, being just a patchset for modern firefox, will suffer from the same bad decisions that plague firefox.

What it seems like the devs don't realize is that even if by some miracle cloudflare fixes this, the message we send is very clear:
"we can easily be pushed around, and those who can do something about it won't. We're a village without guard dogs, thieves welcome."
Palemoon might work for days, months, years, but as soon as someone wants to kill it, we won't put up a fight.

To the devs, please stop ignoring this and do something about it, anything.
Even if it doesn't work, at least try.
It doesn't have to be code, pester those who can fix this at least, ask around, spread the word.
Just don't sit idly and watch palemoon burn.

To all those reading: I'm not just saying "someone else do the work for me".
When I feel I can do something to improve the software I use, I do.

In palemoon, I debugged noscript crashing palemoon and fixed it (I no longer use it, switched to umatrix instead).
In this thread, I found a patch for when cloudflare was crashing. I wasn't the first one to fix that issue, but I still looked into it.
Don't look at the small size of the patches. Any patch I write for palemoon takes me hours to debug, test and rebuild.
Anyone who's tried to debug a large c++ codebase knows how it is.

Librewolf isn't without problems: https://bugs.gentoo.org/show_bug.cgi?id=950352
Guess who reported that issue and spent days working on it.

And I to this for plenty of software.

I'm not asking for work to be done for me.
I am willing to help, I just can't do this alone.
And it's infuriating to see the devs sit around doing nothing.

As a side note, if anyone knows good browser alternatives that support xul extensions, please let me know.

User avatar
Moonchild
Pale Moon guru
Pale Moon guru
Posts: 37762
Joined: 2011-08-28, 17:27
Location: Motala, SE

Re: Cloudflare Verification Loop issues

Unread post by Moonchild » 2025-03-01, 17:27

stefan11111 wrote:
2025-03-01, 16:36
It's been a month, or however long it's been since cloudflare websites stopped working.
It seems to me like palemoon is taking a beating and it's devs notice it, but do nothing about it.
Just because you don't see what all goes on behind the scenes does not mean we "do nothing about it".

As for your "ideas":

1. Cloudflare isn't having a dialogue with us (I've been trying to get that going for the whole time), so we don't know what, if any, their team checks for. We are left hanging. They have made clear through the grape vine they do not want to talk to us in any way, shape or form, not even to have a discussion about the issues their scripting is causing re: hangs as it doesn't find what it wants and just borks in a loop.

2. Adding hacks is what is already being done by way of working around it with firefox cookies. Hacks also only work for as long as CF isn't changing their behaviour again.

3. Impossible, unless we become Blink-based. Even then that is no guarantee that CF is going to suddenly be any more amenable to us and will allow us through. Their "challenges" simply do not support any browser but a very short list as stated on their website and display all sorts of malicious behaviour to other browsers they do not consider "supported".

CF holds all the cards because they have made themselves indispensable for sites, and are now abusing their position to gate-keep which browsers are considered "legitimate" (i.e. "not bots" in their definition) to be used by end users like yourself. As devs of those browsers they decide to treat like bots, we can't do anything if they don't open a dialogue to solve this issue, since they control the access points, they control the scripts, they control the checks.

Short of applying pressure legally or having a big movement to convince people to move away from CF "security" for their sites, we've all but run out of options. If any one of you is an attorney who can help, please do get in touch.
"A dead end street is a place to turn around and go into a new direction" - Anonymous
"Seek wisdom, not knowledge. Knowledge is of the past; wisdom is of the future." -- Native American proverb
"Linux makes everything difficult." -- Lyceus Anubite

User avatar
flamelord
Moonbather
Moonbather
Posts: 57
Joined: 2025-01-31, 03:03

Re: Cloudflare Verification Loop issues

Unread post by flamelord » 2025-03-01, 19:04

Moonchild, what do you make of the post below?
flamelord wrote:
2025-02-28, 23:14

So it seems like many sites with cloudflare are working now, however the ones with the turnstile with the tickbox like 4chan still aren't working.
I think it's likely that science.org didn't fix it but CF fixed it some degree but it seems not fully yet. At last that is what I'm guessing here.
Btw, you're right. I heard reports of Ungoogled Chromium not working with CF either.

User avatar
andyprough
Board Warrior
Board Warrior
Posts: 1118
Joined: 2020-05-31, 04:33

Re: Cloudflare Verification Loop issues

Unread post by andyprough » 2025-03-01, 20:17

flamelord wrote:
2025-03-01, 19:04
I heard reports of Ungoogled Chromium not working with CF either.
That's probably just because so many distros and platforms use badly outdated builds of ungoogled chromium. I doubt Cloudflare can tell the difference between an up-to-date ungoogled chromium vs the same current version of regular chromium, and it should pass current versions through.

User avatar
Mæstro
Astronaut
Astronaut
Posts: 552
Joined: 2019-08-13, 00:30
Location: Casumia

Re: Cloudflare Verification Loop issues

Unread post by Mæstro » 2025-03-01, 20:30

jobbautista9 wrote:
2025-02-28, 05:13
Mæstro wrote:
2025-02-28, 04:26
Ungoogled Chromium (v104·0·5112·101)
That Chromium version is from August 2022. You probably should upgrade that as the latest right now is 133.0.6943.141. :think:
Off-topic:
Thank you for your concern. I installed the OpenSUSE package for UC years ago and never bothered to replace it, for it has been adequate as a backup browser supplementing Epiphany. I have had no reason to do anything sensitive that would require an upgraded browser: eg my credit union’s site works in Pale Moon. UC is chiefly useful for Discord, or else when casually viewing pages which request too many third-party scripts for me to bother untangling in µBlock and friends. I could probably swap Basilisk.
Browser: Pale Moon (official build, updated regularly)
Operating System: Linux Mint Debian Edition 4 (amd64)
※Receiving Debian 10 ELTS security upgrades
Hardware: HP Pavilion DV6-7010 (1400 MHz, 6 GB)
Ash is the best letter.