Bypass Cloudflare with Firefox Cookies

[tellu-white]

For users with Windows operating system I've made an add-on for Pale Moon (a "workaround") that reads cookies from the "cookies.sqlite" file (path = "C:\\Users\XXX\Desktop\FirefoxPortable\Data\profile\cookies.sqlite") and writes them to Pale Moon.

*****

IMPORTANT: Firefox Portable ( FirefoxPortable_134.0.2_English.paf.exe ) must be DOWNLOADED and EXTRACTED to DESKTOP, where it will create the "FirefoxPortable" folder.

Firefox Portable 134.0.2 - LATEST

https://www.filehorse.com/download-firefox-portable/

https://dl.filehorse.com/win/browsers-and-plugins/firefox-portable/FirefoxPortable_134.0.2_English.paf.exe?st=91CzL4zK1LHJ-dBJcs07ng&e=1739641567&fn=FirefoxPortable_134.0.2_English.paf.exe

https://www.virustotal.com/gui/file/17f7cab382cd21e85191b2e82f400364b1ab67212a5c76c697e1764f58b6d7cf

NOTE: I used an older version of Firefox ( Firefox 115.20.0 ), the latest 32-bit version available for Windows 7.

*****

In Firefox you just need to add a "Bookmarklet" (i.e. a Bookmark where instead of URL we have Javascript code).

Get Firefox "user agent" String - Firefox "Bookmarklet":

Name:
Get user agent string

URL:

Code: Select all

javascript:void(prompt('navigator.userAgent',navigator.userAgent))

*****

Screenshots:

01.png

02.png

After accessing the page with issues, when Cloudflare starts to spin press "Ctrl + Click" on the add-on button. This will close the problem page in Pale Moon and open it in Firefox.

NOTE: You can open the problem page DIRECTLY in Firefox with "Alt + Click" on the add-on's button, followed by entering the URL in the "prompt box" that opens.

03.png

04.png

After the page has loaded in Firefox, click on the Bookmarklet "Get user agent string" and copy "user agent" then close Firefox.

05.png

06.png

Back in Pale Moon, "Shift + Click" on the add-on button. This action reads cookies from the "cookies.sqlite" file (Firefox's file) and writes them to Pale Moon. If it's the first time you access the problem page, the add-on will ask you to enter the "user agent" (copied before with Firefox "Bookmarklet").

07.png

Now the problem page will also open in Pale Moon. You can also open it by "Click" on the add-on's button (IMPORTANT: Paled Moon remembers only the last solved problem page - and only in the current session).

08.png

If this add-on is uninstalled, the "user agents" for the tested problem pages must be manually deleted in "about:config" like this:

09.png

*****

NOTE 1: I've tested this add-on on three problem pages whose URLs were posted by users of this forum:

https://janitorai.com/

https://drunkenslug.com/

https://forums.nrvnqsr.com/

Those interested in this workaround can try this add-on on other problem pages (and post feedback).

NOTE 2: As I said in a previous post, this add-on does not work when a page uses Cloudflare every time it is opened, as is the case for https://tinyurl.com

NOTE 3: I have to mention that I had to (periodically) redo the process of copying cookies from Firefox to Pale Moon, so I don't know how long the cookies are valid. However, after I loaded them back into Pale Moon, I was able to browse the sites without any problems.

*****

Download link ( Bypass Cloudflare with Firefox Cookies 1.2 ):

https://www.mediafire.com/file/gzoi109q0cee3y0/bypass_cloudflare_with_firefox_cookies_1_2.zip/file

[back2themoon]

Many thanks for your efforts, tellu-white. It works as described and effectively bypasses the problem. A few observations:

1. Since these problem websites currently lock/crash Pale Moon, I think you should only keep the "Open directly in Firefox method ("Alt + Click"). There is no way to use your extension if the browser crashes. Perhaps on more modern systems Pale Moon takes longer to lock up (out of memory), but for me it becomes unusable almost immediately.

2. Please consider supporting the non-portable, standard (and official) Firefox installation.

Even if tellu-white's intelligent solution works, under no circumstances should this prevent us from demanding answers from Cloudflare.

[tellu-white]

@back2themoon

Thank you for the feedback. I will think about the observations you made.

As I said, my add-on is just a "workaround", not a definitive solution. The way Cloudflare understands to deal with the pertinent requests of those unfairly affected by their abusive practices is morally reprehensible (if nothing else). You are right when you say that we must insist on getting answers from them about the (illegitimate) arbiter role they believe they are entitled to play.

[Michaell]

Why would anyone want to do all that? Easier to just use the other browser.

[Moonchild]

Why would anyone want to do all that? Easier to just use the other browser.

Because some people are advanced users who would prefer to combat the discrimination rather than "bow to the king" (to quote).

[back2themoon]

Why would anyone want to do all that? Easier to just use the other browser.

You might as well say there's no issue at all, and this continued Cloudflare talk is pointless. "Just use the other browser".

Tellu-white's lengthy posts might scare some people off, but this solution is neither complicated, nor lengthy. You have those websites working back in Pale Moon again. That's why anyone would want it.

[Mæstro]

How could we in Linuxland do something like this? As a stopgap, I have been treating the Wayback Machine as proxy and using URL Redirect to convert automatically for more frequent sites.

[Nuck-TH]

At this point CF officially is security theatre. They don't even check if client fingerprint matches cookies. WTF?!

[Moonchild]

It makes me wonder if the cookies can be faked with some clever analysis of what's actually in them for various sites.

[jobbautista9]

Would be funny if a tech journalist reports on that. Imagine how the stock market would react if their investors realize that one of CF's "best selling products" turns out to be nothing more than snake oil...

[tellu-white]

jobbautista9 wrote:
Would be funny if a tech journalist reports on that.

https://forum.palemoon.org/viewtopic.php?f=71&t=32098#p259760

If this would happen, it would not be in the Pale Moon users' interest because my add-on would no longer work.

*****

@back2themoon wrote:
Please consider supporting the non-portable, standard (and official) Firefox installation.

https://forum.palemoon.org/posting.php?mode=reply&f=71&t=32098#pr259736

Unfortunately, this option complicates things a lot. To read cookies from the "cookies.sqlite" file (a Firefox file) I need to know its path. This path cannot be obtained with Pale Moon functions because this file belongs to Firefox and not to Pale Moon. I installed Firefox for testing (until now I only had Firefox Portable) and I got the following result:

01.png

02.png

I don't know why there are 3 "default" folders and why there are 2 "cookies.sqlite" files in 2 separate "default" folders. It might be because the first attempt to install Firefox with the "msi" version failed (without Internet connection). Anyway, potential users could install either the default version of Firefox or the "esr" version so that the path to the "cookies.sqlite" file is not unique. I could ask users to "browse" to find the location of the file but I'm not sure all users would know where to look for it. For these reasons, I chose to stay with the Firefox Portable add-on.

@back2themoon wrote:
Since these problem websites currently lock/crash Pale Moon, I think you should only keep the "Open directly in Firefox method ("Alt + Click"). There is no way to use your extension if the browser crashes.

https://forum.palemoon.org/posting.php?mode=reply&f=71&t=32098#pr259736

I don't think I should remove an option based on current situation. It's possible that after a while Cloudflare will stop blocking Pale Moon, even if it won't solve the underlying problem: access to the problem pages. For now, users can opt to open the problematic pages directly in Firefox, with the "Alt + Click" option on the add-on's button.

*****

I've made a new version of this add-on (1.3) in which I've added another option: opening in Firefox the pages that display the following message:

"Unfortunately, your browser is unsupported. Please switch to a supported browser to view rich content, log in and reply".

With the existing options in version 1.2 this is not possible because these options trim the URL and only use the "pre Path URL" to get cookies from Firefox.

Screenshots:

03.png

04.png

05.png

*****

Download link ( Bypass Cloudflare with Firefox Cookies 1.3 ):

https://www.mediafire.com/file/trfkg3ln439f52m/bypass_cloudflare_with_firefox_cookies_1_3.zip/file

[Mæstro]

Would be funny if a tech journalist reports on that. Imagine how the stock market would react if their investors realize that one of CF's "best selling products" turns out to be nothing more than snake oil...

Any of us could give the press a tip…

[back2themoon]

@back2themoon wrote:Please consider supporting the non-portable, standard (and official) Firefox installation.

Unfortunately, this option complicates things a lot.

Ok never mind, thanks for trying.

I've added another option: opening in Firefox the pages that display the following message: "Unfortunately, your browser is unsupported.

Isn't this the Discourse issue that requires other types of fixes i.e. using your "Intercept..." extension? Does the same cookie/user agent Cloudflare method work on these, too? Your instructions are not very clear for this new feature, but the procedure seems similar. Anyway, I tried with https://resource.dopus.com/ but couldn't make it to work so I just reverted to using "Intercept...".

Suggestion: use hide tags for your images, because they make your posts (and entire topic) very long and difficult to browse.

[Moonchild]

Unfortunately, this option complicates things a lot. To read cookies from the "cookies.sqlite" file (a Firefox file) I need to know its path.

How about letting the user pick the file location? And aside from a text input field, you can just use a file open dialog to get the exact path if someone browses to it.

[tellu-white]

@Moonchild wrote:
How about letting the user pick the file location? And aside from a text input field, you can just use a file open dialog to get the exact path if someone browses to it.

https://forum.palemoon.org/viewtopic.php?f=71&t=32098#p259777

The "file open dialog" option is what I had in mind when I said that "I could ask users to 'browse' to find the location of the file but I'm not sure all users would know where to look for it".

As can be seen in the posted images, finding the path to the "cookies.sqlite" file can be tricky. In some posts I've seen some users having difficulties finding the location of the "userChrome.css" file. This is the reason why I think it is much easier to extract Firefox Portable to the Desktop. Users who already have Firefox installed can use the "portable" version just for this add-on. I don't see why this should be a problem.

@back2themoon wrote:
Isn't this the Discourse issue that requires other types of fixes i.e. using your other "Intercept..." extension? Does the same cookie/user agent Cloudflare method work on these, too? Your instructions are not very clear for this new feature, but the procedure seems similar. Anyway, I tried with https://resource.dopus.com/ but couldn't make it to work so I just reverted to using "Intercept...".

https://forum.palemoon.org/viewtopic.php?f=71&t=32098#p259775

The option to open in Firefox the pages that don't open correctly in Pale Moon for reasons unrelated to Cloudflare is actually an extra-option that was available to me. These pages can't be opened in Pale Moon with Firefox cookies, so they have to be browsed in Firefox. The ones that can be resolved with the "Intercept & Modify HTTP Response" add-on don't need this add-on.

[moonbat]

The "file open dialog" option is what I had in mind when I said that "I could ask users to 'browse' to find the location of the file but I'm not sure all users would know where to look for it".

Users who know enough to use Pale Moon and Cloudflare and are willing to jump through various steps instead of giving up and using another browser should be quite capable of figuring out where Firefox is. In fact you could make it even easier - see if the path to the default location of the Firefox executable (/usr/bin/firefox on Linux, C:\Program Files\Mozilla/Firefox/firefox.exe' or similar on Windows) is valid and only prompt the user if it isn't.

Building an extension or any application requires careful thought about the UI, before diving into implementing the functionality.

[back2themoon]

Users who know enough to use Pale Moon and Cloudflare and are willing to jump through various steps instead of giving up and using another browser should be quite capable of figuring out where Firefox is.

I have to fully agree with this.

Also, adding an extra feature which is irrelevant to the extension name and initial functionality, is more likely to confuse users. Talking about the "Unfortunately, your browser is unsupported" fix which is usually Discourse-related and won't work anyway.

Having said the above, I'm sure we all hope the Cloudflare situation is temporary and will soon be resolved, one way or another. Whatever tellu-white does with this extension is perfectly fine and welcome.

[frostknight]

For users with Windows operating system I've made an add-on for Pale Moon (a "workaround") that reads cookies from the "cookies.sqlite" file (path = "C:\\Users\XXX\Desktop\FirefoxPortable\Data\profile\cookies.sqlite") and writes them to Pale Moon.

Can this work for linux users? Also, is it possible to simplify this so you only need the addon itself to do all of this?

Just asking.

[tellu-white]

I've noticed that all those providing feedback want a version of the add-on that provides the option to use paths to the installed version of Firefox. For those who want this I have made version 2.1 of this add-on in which both the path for the Firefox executable and the path for "cookies.sqlite" must be entered.

This version can also be used in Linux. I have a 32-bit PC so I tested it in "Linux Mint 19.3 Cinnamon 32-bit".

frostknight wrote:
Can this work for linux users? Also, is it possible to simplify this so you only need the addon itself to do all of this?

As I said, version 2.1 is also for Linux.

This add-on only needs a "Bookmarklet" in Firefox to easily extract the "Firefox user agent". If you know how to extract this "user agent" from the INSTALLED Firefox, then you don't need this "Bookmarklet".

*****

EDIT:

Important notice for users of some Linux distros !

When I tested my add-on in Linux Mint Cinnamon, I found that there was a problem with using the ALT key in Pale Moon. Looking for an answer, I came to this page:

Problem with Alt key in Linux Mint

https://forums.linuxmint.com/viewtopic.php?t=403820

At the post with the link below you can see screenshots I took when I solved this problem for another add-on.

https://forum.palemoon.org/viewtopic.php?f=70&t=31829#p257542

*****

Screenshots:

01.png

02.png

The above message is only received if the Path to the Firefox app has not already been entered.

03.png

04.png

05.png

The above message is only received if the Path to the Firefox's "cookies.sqlite" file has not already been entered.

06.png

07.png

08.png

09.png

*****

Download link ( Bypass Cloudflare with Firefox Cookies 2.1 ):

https://www.mediafire.com/file/sjwlil98ooisgn9/bypass_cloudflare_with_firefox_cookies_2_1.zip/file

[back2themoon]

I have made version 2.1 of this add-on in which both the path for the Firefox executable and the path for "cookies.sqlite" must be entered.

Thank you, works fine.