Cloudflare Verification Loop issues

[Moonchild]

CloudFlare has been radiosilent on this so far.
There isn't much more outreach I can do here. I e-mailed, sent a forum message and posted in their dedicated board on CF community... Just more BS that isn't making for a fair playing field.

[Kand_in_Sky]

Don't expect anything before end of the week

first they wonder what's going on and "test" the complains on a mobile phone with chrome, so it will all work and they ignore the complains,
next day the test maybe on PC or MAC, again with chrome, the h4x0rs even test it with FF! wow!
'bcause the complains don't stop and they can't blame it all on outdated weird browsers, then maybe someone gonna take a deeper look what's going on,
on friday they maybe realize they the code is shiet and try to fix it OR just make a rollback to last working version while fixing in background the shiet they made.

with luck on monday it will work again and we wait for the next big pile of shiet (aka "update") in a few months.

(only a projection of experiences gained with them)

[franstam]

if only, they would realize they were wrong and rollback! fat hope on that happening.

i think i would go try out the extension and workaround being posted with my firefox esr version.
not gonna deal with this crap junk, its just ridiculous now.

thanks for whoever is updating that addon.

[back2themoon]

Perhaps it's now rebranded as the "Turnstile Resurrection Program".

[KlarkKentThe3rd]

[everything you wrote]

That was beautiful, thank you.

[JayByrd]

Well, this "infinite cloudflare loop" has finally bitten me on a site that I use regularly: linuxquestions.org. I've brought it up to the LQ admins; maybe they can put some additional pressure on CF.

[Night Wing]

Well, this "infinite cloudflare loop" has finally bitten me on a site that I use regularly: linuxquestions.org. I've brought it up to the LQ admins; maybe they can put some additional pressure on CF.

You might have some luck on this point. I'll explain.

I have been visiting the MX Linux Forum site for the last two years on a daily basis (when possible) when using my linux Pale Moon. And I could always visit the the site without any problems.

https://forum.mxlinux.org/

Then I started getting the CF prompt when I wanted to visit the site and I could not get the site to load since Pale Moon could not get past the challenge. I had to use my backup linux Waterfox browser which passed the CF challenge and allowed me to visit the site. Then after a few weeks of time, I no longer encountered the CF challenge with Waterfox and went straight to the site.

Maybe the maintainers of the MX Linux Forum site recognized my IP address or something which told the maintainers I was not a bot. Then on a hunch, one day I tried again to visit the site using Pale Moon and again, I met the CF challenge. This time though, Pale Moon passed the challenge and I visited the site.

But over the last two weeks, I have been able to get to the site using my Pale Moon browser without encountering the CF challenge. Maybe the maintainers of the site recognized my IP address (again) telling them I was not a bot. Only the browsers were different.

Earlier today, I visited the MX Linux Forum site using Pale Moon and never encountered the CF challenge and the site loaded for me without any problems.

[andyprough]

I tried again to visit the site using Pale Moon and again, I met the CF challenge. This time though, Pale Moon passed the challenge and I visited the site.

But over the last two weeks, I have been able to get to the site using my Pale Moon browser without encountering the CF challenge. Maybe the maintainers of the site recognized my IP address (again) telling them I was not a bot. Only the browsers were different.

This is some interesting news. I've tried for weeks to get into the MX forum with Pale Moon with no success. Right now I have it open in a tab and the idiotic Cloudflare thingey is just spinning and spinning.

I wonder what you did differently to get in?

[Gemmaugr]

This is some interesting news.

Interestingly weird. I've never visited that site before, but I got in without a CF challenge. LinuxQuestions is a no-go though.

[Night Wing]

This is some interesting news. I've tried for weeks to get into the MX forum with Pale Moon with no success. Right now I have it open in a tab and the idiotic Cloudflare thingey is just spinning and spinning.

I wonder what you did differently to get in?

I started using the MX Linux distro about two years ago in conjuntion with Mint and Debian. Then after I quit using Mint, MX Linux and Debian were the only two linux distros I have been using since I quit Mint.

In all of that time, I have not changed anything with my present linux 64 bit (GTK2) Pale Moon (34.2.0). I have only two extensions installed with Pale Moon and they are uBlock Origin 1.16.6.1 and Zoom Label (1.3). The only theme I use for Pale Moon is Past Modern Revisited (2.11.0). This is on my "main" desktop tower computer.

I can also get their site to load without encountering the CF challenge anymore using my "backup" desktop tower computer with as of this date is linux 64 bit (GTK2) Pale Moon (34.2.0) with the same two extensions above and with the same theme as above.

I am taking a wild guess the maintainer(s) of the MX Linux Forum site are recognizing my ISP is not a bot because I have been visiting the site for the last two years on a everyday basis.

[andyprough]

OK I have a response from Cloudflare on the issue I raised via my Cloudflare account. I've PM'd the response to @Moonchild and @Basilisk-Dev in case they had not already seen it. Apparently this problem is now being worked on. Not sure how soon things will improve. Might want to let everyone know if you start getting past Cloudflare challenges sometime in the next few days.

[BenFenner]

But they added Pale Moon to their test suite a long time ago. How could this be?!

[Night Wing]

But they added Pale Moon to their test suite a long time ago. How could this be?!

My guess is; CF keeps changing things and sometimes, like now, those changes cause problems for Pale Moon.

[Kand_in_Sky]

i highly doubt they tested it with PM, even the feedback does not work in PM.
"an unknown error occurs. try again later" is the only thing you get after tried to send feedback.

cloudscam is funny.png

[xenergyx]

really night wing ? With days of delays to fix that so called issue out of the blue when many safe list browsers are still active ? & while chrome's swimming
in the bluest & purest sea with all those changes never affecting chrome or waterfox ? & i believe the authors of cloudflare are trying to push people to use more popular browsers
from time to time, & that's why chrome is in their safelist .. .

[Gemmaugr]

really night wing ? With days of delays to fix that so called issue out of the blue when many safe list browsers are still active ? & while chrome's swimming
in the bluest & purest sea with all those changes never affecting chrome or waterfox ? & i believe the authors of cloudflare are trying to push people to use more popular browsers
from time to time, & that's why chrome is in their safelist .. .

They've got their perfect goose and golden egg. Most popular browser means majority customers satisfied, and chrome/ium being the easiest to bot with means they facilitate the problem and the solution.

[Night Wing]

really night wing ? With days of delays to fix that so called issue out of the blue when many safe list browsers are still active ? & while chrome's swimming
in the bluest & purest sea with all those changes never affecting chrome or waterfox ? & i believe the authors of cloudflare are trying to push people to use more popular browsers
from time to time, & that's why chrome is in their safelist .. .

On November 18th, 2025 and also on February 20th of 2026, CF had some major internal problems which affected about 20% of the internet. And you can look that up if you want to fact check me.

Back on point.

When those two outages happened, I image some of those affected websites on those two dates have a monetary contract with CF to keep bot traffic at bay. Even Chrome did not work either. I'm guessing and the key word is "guessing"; those websites where users using Chrome could not get through, if I owned one of those websites, I would have told CF to get it's act together or at contract renewal time, the contract would not be renewed.

If the hypothetical above came to pass; I imagine if I was running or controlling CF and did not want to loose any "lucrative money contracts", I would play it "safe" and only protect those money sites from bots for users using Chrome, Edge, Safari and Firefox which are those browsers which internet users use the most market share wise.

In other words, big mainstream browsers which are not considered "niche" browsers which I "guess", CF classifies Pale Moon as a niche browser. Therefore Pale Moon is always going to be considered a "scullery maid" like Cinderella was when it comes to dealing with CF.

In other topics on this site where CF is being discussed extension wise or add on wise, they have unblocked CF where Pale Moon works. But that is a temporary work around and eventually, CF will change things again internally and that work around will not work anymore. It is like the game, "whack-a-mole".

I do not use the "work arounds" for Pale Moon because I know these are just temporary fixes when dealing with CF. I take the easy way out and just use my backup Waterfox browser to get to the sites I "need" to get through to when CF blocks Pale Moon. If Waterfox does not work, then I go to my third browser preference wise, Firefox.

And if you want to give me a hypothetical question and ask me if none of my three browsers (Pale Moon, Watefox, Firefox) no longer work, then I would have to "bite the bullet" and no longer visits those sites CF is protecting. I'd hunt for alternative sites because I am never going to use Chrome or Edge. I left out Safari because I do not own an Apple computer.

[Moonchild]

To keep people in the loop here, the response given by CloudFlare was this:
(do read below the quote how it was not even correct)

Thanks for your patience. We’ve identified the root cause of the challenge loops and have an update on a short-term fix.

Root Cause
Pale Moon’s implementation of WebGLRenderingContext.getContextAttributes() is missing the powerPreference field that Firefox (version 100+) and other modern browsers include. This causes our challenges to receive an invalid payload and incorrectly flag users as bots.

We’ve implemented a fix that will go out in our next release to unblock your users. However, this is a temporary bridge. We’re patching around a Web API compatibility issue that should be fixed in Pale Moon itself.

Ask
To match modern Firefox behavior (version 100+), Pale Moon needs to implement getContextAttributes() with the complete attribute set, including powerPreference. This will ensure compatibility not just with Cloudflare, but with other sites relying on standard WebGL behavior.

Also, while I have you, we are still seeing issues with the Pale Moon CSP implementation. Would you be able to take a look?

Any other ideas/suggestions?

Beyond this immediate fix, I’m interested in building a more sustainable partnership between Pale Moon and Cloudflare. Previously we made exceptions in our logic for Pale Moon, but those are now exploited by bots, and are no longer a viable option for our customers. We want to protect apps without blocking legitimate traffic, and I know you want the same for your users. What does a sustainable partnership look like from your perspective? Have you seen anything work well in the past?

I’m looking forward to your thoughts and working together!

I've put in time this morning to implement the completely optional hint property to canvas WebGL context (Issue #3042 (UXP)) only to find out that it didn't in fact solve the problem at all; the exact same error gets thrown. "Found the root cause"? nope, they did not. But maybe they think it would have been hard to home in on and add? It was pretty trivial.
Also, "matching modern Firefox" still did not acknowledge that UXP isn't Mozilla, and Pale Moon isn't Firefox, and our independent nature is still completely ignored.
Also, CSP issues? There should not be any because their turnstile troubleshooting page which should be entirely without specific Pale Moon mitigations passed with flying colours for the longest time, and CSP hasn't changed since then. So it's all a bunch of either miscommunication within CF, or trying to mask incompetence, or worse.

I’m interested in building a more sustainable partnership between Pale Moon and Cloudflare.

Deja vu, anyone? This should have been a priority a year ago. They really can't be serious pretending this is a first outreach or start of building something.

Needless to say they got a pretty wordy piece of my mind as a result. I'll have to wait and see what they are intending going forward.

[jobbautista9]

Pale Moon’s implementation of WebGLRenderingContext.getContextAttributes() is missing the powerPreference field that Firefox (version 100+) and other modern browsers include.

It should be noted that the powerPreference field they're saying is currently only in a working draft (annoyingly there doesn't seem to be a permalink for this current version of the working draft). It is currently not available in the latest WebGL specification (1.0.3): https://registry.khronos.org/webgl/specs/1.0.3/#5.2

It doesn't matter that Firefox 100 has implemented it. Cloudflare is just simply forcing the implementation of draft features we haven't even heard about (because we don't care about turning the web browser into a third-rate, insecure replacement of the operating system that mainstream is doing)

[Night Wing]

I like the way Cloudflare uses the sentence and I'm going to quote it:

Thanks for your patience. We’ve identified the root cause of the challenge loops and have an update on a short-term fix.

The words which jump out to me are: "short-term fix". Which means to me; "waiting for the next shoe to drop which will screw Pale Moon again like CF has done for the past 12 months". Rinse and repeat.

I never have any problem using Pale Moon to get to YouTube, Amazon and eBay. Probably because these sites are big online money making entities and have lots of money behind them. Take Amazon as an example.

Amazon's largest individual shareholder is Jeff Bezos who owns approximately 9% to 9.6% of the company's outstanding shares of stock as of early 2026. Bezos has enough "sway" (influence) in the company to get what he wants and if he wants to hire tons of programmers to keep bots at bay, the company will.

Bottom (money wise) line. Amazon does not need CF.