Bot Fight Mode Using Deprecated APIs (Flagged by Google)

[Aviator]

After enabling Cloudflare’s Bot Fight Mode (BFM) and running Google Lighthouse, we have learned that BFM is using deprecated APIs to detect bots. Once the deprecated APIs are removed from popular browsers, the bot detection capabilities of BFM may suffer.

Details: Screenshot by Lightshot

Is Cloudflare’s DevOps Team aware of this? If so, can you share more info? What’s the next step to address this?

Thank you!

[cherryjimbo]

I’m not sure this is something that needs to be addressed.

It’s very common for scripts that are intended to work across lots of browsers (especially older ones) to use deprecated APIs. Something like Bot Fight Mode has to support pretty dated browsers, so it’s likely this code is in place to work on these old browsers and are safely just ignored in modern ones.

Are you seeing any actual issues? Otherwise this Lighthouse warning is benign and safe to ignore.

[Aviator]

Hi @cherryjimbo,

Thanks for your input. So, what do you think will happen when updated browsers stop supporting the deprecated APIs? The answer takes us back, perhaps, to my initial inquiry or statement (i.e., bot fight mode detection capabilities may suffer)

Again, thank you.

[cherryjimbo]

What makes you think that? The code is likely wrapped in something like:

if ('someFeature' in window) {
    // use new API
} else if ('someOldFeature' in window) {
   // use old feature in old browsers
} // etc.

That code would trigger deprecation warnings by tools like Lighthouse, but have no ill effect even if that entire API was deleted from the browser tomorrow. You will find reports of this going back a long time such as Uses deprecated APIs Deprecation / Warning in web.dev. I wouldn’t worry about it.

[Aviator]

Hey @cherryjimbo,

Not worried, ever

You’re probably right. It would be great; however, to receive input from a Cloudflare DevOps team member. Separately, we’ll dig a bit more to see what we can find.

Cheerio!

[mdemoura]

Hi @Aviator, I’m an engineer on the team that maintains Challenge Pages, Turnstile and thus BFM.

Removal of the API in question does not affect BFM, you can ignore the warning.

[Aviator]

Hi @mdemoura,

Thank you! Good to know.

One final question: Does CF plan to remove or update the deprecated APIs at some point, or, is your code written in a fashion similar to the one shared by @cherryjimbo? That is, to permanently support both old and new browsers.