API request from customer blocked by recaptcha challenge

Security
#1

When our customers activate their license, it sometimes get blocked by Cloudflare. When looking in the response on the API request, we’ve found that Cloudflare responds with a reCaptcha challenge. As the response is handled by code, not a user, this obviously fails.

I’ve tried adding a firewall rule that accepts all post requests, just to check if that helps. Which it doesn’t. Allowing URL’s or IP’s is also not possible, as these are lots of different customers. How can we disable this feature for such requests?

#2

Find the rule being triggered in the firewall logs and disable it perhaps?

1 Like
#3

I see this as “Managed challenge” in the logs, with Rule ID ‘badscore’. But I don’t see any option to disable a “Managed challenge”, or specific Rule ID’s. Is this actually possible?

#4

That challenge may then be based on the repurtation of the visitor’s IP address, in which case you can change the security level: https://support.cloudflare.com/hc/en-us/articles/200170056-Understanding-the-Cloudflare-Security-Level

3 Likes
#5

Ah, thanks. I’ll try if that helps.

#6

This seems to have resolved the issue for most customers. Several of these customers are probably located on a shared hosting environment, the ip number of which was listed in https://www.projecthoneypot.org. Thanks for the pointer!

1 Like
#7

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.