Do Workers have CAPTCHA challenges?

Developers Workers
1

Hi, I’m looking into Cloudflare Workers and was wondering if CAPTCHA challenges also block suspicious Worker requests. If I want to develop a simple REST API using Workers then I can’t have CAPTCHA challenges block requests since this will not be possible to process by the API consumer.

So what I need to know is if CAPTCHA challenges are a thing with Cloudflare Workers and if so then I’d like to know if the can be completely disabled.

2

I’ve done distributed load at 50 000 req over 40 seconds, not a single one has got stuck in a captcha.

That said, it would be best if CF could answer this officially since I don’t know what the policy is.

3

Thanks for the info, if a Cloudflare employee could confirm this that would be awesome.

4

If you want you can turn security to “Essentially off” for those routes or the equivalent page rules. That will basically disable challenges.

5

You can also make a firewall rule to allow everyone within an IP range

That being sad, I’ve still heard of some extreme cases where cloudflare blocks/challenges bad actor ips regardless

6

I think this is actually a real problem. I have an image resizing worker that’s being challenge/blocked by a country-based Cloudflare firewall setting. I can understand Cloudflare protecting any request before it gets to the worker, but Cloudflare’s own workers should never be presented with a Cloudflare challenge page! Basically, Cloudflare should always implicitly trust its own edge servers.

Below is the error I get when my image resizing worker tries to access an image, when the request is made from a Cloudflare edge server located in a country for which I’ve requested a challenge page:

Could not fetch the image — the server returned HTTP error:
status: 502
statusText: Bad Gateway
headers: {}
redirected: false
url: 
webSocket: null

... in response to a request to https://www.example.com/sample.jpg

I cannot seem to get around this. Cloudflare workers are not allowed direct IP access to my origin server, and lifting all security for the origin image in page rules has not helped.

Any ideas?

Here is my worker code:

addEventListener("fetch", (event) => {
	event.respondWith(
		handleRequest(event.request).catch(
			(err) => new Response(err.stack, { status: 500 })
		)
	);
});

async function handleRequest(request) {

	const ORIGIN = 'https://www.example.com/'; // origin of the images, with trailing slash

	// Parse request URL to get access to query string
	const url = new URL(request.url);

	const path = url.pathname;  // get path and file part of URL
	console.log('path: '+path);

	// Cloudflare-specific options are in the cf object.
	const options = { cf: { image: {} } };

	// Set defaults
	options.cf.image.width = 600;   // default to something not too monstrous
	options.cf.image.fit = 'scale-down';
	options.cf.image.sharpen = 0.6;
	options.cf.image.quality = 95;
	options.cf.image.background = '#FFFFFF';

	const imageURL = ORIGIN + 'images/sample.jpg';	// get origin server's full path to image, hardcoded here for simplicity

	// Build a request that passes through request headers,
	// so that automatic format negotiation can work.
	const imageRequest = new Request(imageURL, {
		headers: request.headers,
	});

	// Returning fetch() with resizing options will pass through response with the resized image.
	let response = await fetch(imageRequest, options);

	// Reconstruct the Response object to make its headers mutable.
	response = new Response(response.body, response);

	if (response.ok || response.status == 304) {
		response.headers.set(
			'Cache-Control',
			'public, max-age=0, immutable',
		);

		// Set Vary header
		response.headers.set('Vary', 'Accept');

		return response;
	} else {
		return new Response(
			`Could not fetch the image — the server returned HTTP error:
status: ${response.status}
statusText: ${response.statusText}
headers: ${JSON.stringify(response.headers)}
redirected: ${response.redirected}
url: ${response.url}
webSocket: ${response.webSocket}

... in response to a request to ${imageURL}`,
			{
				status: 400,
				headers: {
					'Cache-Control': 'no-cache',
				},
			},
		);
	}
}
7

Keep mind mind a user is given a challenge page when coming in from countries in my “suspicious” firewall list. However, even thought the user may meet and pass the challenge page, the worker then attempting to access the image is being blocked from the resource.

8

Fixed!

Although Cloudflare support could not reproduce this on their end, the workaround was to make a new firewall rule before my country challenge rule. This would look for a URI containing my origin image (“images/sample.jpg”) and set the action to “Allow”. My mistake was thinking that a page rule set to “Disable Security” would accomplish the same thing.

9

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.