Near-infinite loop of human verification

[cyandream]

Answer these questions to help the Community help you with Security questions.

What is the domain name?
Most recently this occured on the URL: https://chat.openai.com/chat, however it also occurs in many other places I haven’t documented, all protected by Cloudflare captchas.

Have you searched for an answer?
Yes, and found this, with no answer, and the problem is obviously still occuring. https://community.cloudflare.com/t/infinite-loop-of-hunan-verification-loop/475275

Please share your search results url:
https://www.google.com/search?q=cloudflare+makes+me+verify+indefinitely&rlz=1C1CHBF_enUS923US923&oq=cloudflare+makes+me+verify+indefinitely&aqs=chrome..69i57.5901j0j4&sourceid=chrome&ie=UTF-8

Describe the issue you are having:
When trying to pass a Cloudflare captcha, it makes me answer it multiple times, sometimes 10+, and I often give up before finding out if it’s infinite or will complete.

What error message or number are you receiving?
None, it just continuously makes me complete a new captcha. Happens on all kinds, the simple click the checkbox seems to be the worst, often with 10+ tries necessary.

What steps have you taken to resolve the issue?

1. Incognito mode
2. Bypass proxy for Cloudflare + discord + openai.com
3. Disable HTTPS proxy entirely.

Was the site working with SSL prior to adding it to Cloudflare?

What are the steps to reproduce the error:

1. Visit chat.openai.com/chat
2. Click the captcha checkbox
3. Repeat 12x until it lets you in (or just asks again to solve the captcha)

Have you tried from another browser and/or incognito mode? Yes, the results are indistinguishable.

Important info:
It seems this started happening after I began using Fiddler as an HTTPS proxy (with the Fiddler cert trusted at the OSA level) for some work I’ve been doing, I believe it also led to discord banning me immediately after solving a Cloudflare captcha…

I have since disabled the proxy on all discord + Cloudflare domains I could think of, but today I still had the issue, even with the proxy fully disabled.

[cyandream]

It also happened on this page:
https://www.hostpapa.com/knowledgebase/list-useful-commands-manage-exim-mail-server/
Took 6 successful checkbox captchas to get thru -.- this is ridiculous.

Can you please fix this, I’m betting my IP is flagged because i was using a proxy, even though that’s ridiculous, because it was a LOCAL PROXY so it was still only me using my regular IP address.

[cf1337]

Same problem, stuck in Cloudflare captcha verification.

[nebojsatumbas]

I am also experiencing the same issue on Kumascans

Sometimes the Loop just stops after 4-5 attempts, but on some days I try over 20 times before giving up but it just does not go away.

Refreshing, clearing cache, nothing helps.

[jnperamo]

@cyandream

It seems this started happening after I began using Fiddler as an HTTPS proxy (with the Fiddler cert trusted at the OSA level) for some work I’ve been doing, I

Fiddler has a known JA3 fingerprint, it’s likely that the bot protection saw that the fingerprint of your connection and the UA didn’t match and flagged you.

I believe Cloudflare doesn’t do this aggressive flagging by default, its likely that the site owner added firewall rules to detect and flag/block Fiddler users.

@cyandream

I have since disabled the proxy on all discord + Cloudflare domains I could think of, but today I still had the issue, even with the proxy fully disabled.

This is where things get odd, after you disable fiddler, you should be good to go. Can you verify fiddler isn’t running in the BG? I had that happen in the past.

For all the other people that is having issues, can you share the following?

1. Browser and version.
2. Do you have any privacy focused extension?
3. Does the error occur with turnstile or does it happen with any “loading”/“challenge” page?
4. Can you share some RayIDs where the challenge looped?

@cf1337 @cyandream @nebojsatumbas

[nebojsatumbas]

1. Chrome, always updating to latest public version imediately (+ I have a separate beta for testing purposes)
2. AdBlocker and Avast extension
3. What is “turnstile”??? I seldom recieve the error on the “challenge” page. But it’s always just aa checkbox.
4. Ray ID: 7aac5a80d8bac314
5. Ray ID: 7aaca945fb5438b3
6. Ray ID: 7aacaaccddee38b3

• 3 times then it went through this time

[jnperamo]

@nebojsatumbas

Avast extension

Could you try to replicate the infinite/long loops without the avast extension? I suspect the extension might be spoofing some parameters of your browser that are typically used to flag bots.

[DarkDeviL]

I would also try removing the “AdBlocker”, as it appears that Chrome and various AdBlock extensions together have shown conflicts like that.

[user16358]

It happens when i have Ruffle chrome extension installed Ruffle - Chrome Web Store
Ray ID: 7ab5a0adcdaa13ba

[nebojsatumbas]

@jnperamo

Could you try to replicate the infinite/long loops without the avast extension?

Disabled all extensions. Issue repeated.

[jnperamo]

Can you share some RayIDs where the issue still occurs with the extensions disabled/removed?

[JustSomeGuy]

Hey, glad to see this issue was reported.
From what I can tell, it’s essentially the same issue that was reported in '22

Managed Challenge issue

hi all i have set up firewall rule a few months ago to challenge all users with “Managed Challenge” [111111] It worked without problems when I did it, but about a week ago, the interface that checks visitors on my site has been changed… the old one: [f14fb030946bd5e44aa77fa7a0f4bf53136238f5] the new one: [new] and the new ones can never be bypassed, I even tried VPN, It’s like a “Block” not “Managed Challenge” I added my Home IP at “Tools” inside “WAF” make it ‘allow’, but it’s no lo…

However, this does not appear to be related to ZARAZ this time. My IP is accurate, but the loop happens repeatedly.

The only work-arounds I have found are:

• let the window sit for a while before retrying… sometimes it works.
• Sometimes incognito works
• Disable managed challenge WAF setting or page rule.

Ray IDs that have repeated for my sites:
Ray ID: 7ac1ab0adf2a29b4
Ray ID: 7ac1abfe5b5e2c5c
Ray ID: 7ac1aeeb9cc58698

[nebojsatumbas]

@JustSomeGuy

• let the window sit for a while before retrying… sometimes it works.
• Sometimes incognito works

Yup, for me it’s also resolved in either of these two… but there is absolutely no rules to it so I am even unsure if the incognito is the one who works or I just waited enough…

[nebojsatumbas]

@JustSomeGuy

From what I can tell, it’s essentially the same issue that was reported in '22

The last time this was resolved it involved an ticket and later on the ticket was escalated. However, this time users are reporting this issue rather than site admins. Will this be resolved or are we going to be forced to reload and “Cool off” from visiting mentioned sites as the topic will get burried under the rubble?

[JustSomeGuy]

It seems you don’t intend to ask me, but maybe? I am a site admin, I came here to report but was happy to see this is a wide-occurring issue… but maybe it’s not gaining the attention of those who need to see it.

[JustSomeGuy]

Please see above?

[rhodrimmd]

Hi All,

I am also hitting the same issue, seen with tinyurl and a couple others. On googling found this thread and also one on OpenAI

I did have an issue like this a month ago but that quickly resolved itself when i cleared the cookies out for that site.

Additionally i do also use PiHole though have not seen that block anything Cloudflare related.

[kevb57]

has this been resolved?
it is happening to me on several sites i am trying to access including chatgpt

i reebooted, i tried incognito not good

[kevb57]

tick the box, it just goes in circle