Near-infinite loop of human verification

Website, Application, Performance Security
1

Answer these questions to help the Community help you with Security questions.

What is the domain name?
Most recently this occured on the URL: https://chat.openai.com/chat, however it also occurs in many other places I haven’t documented, all protected by Cloudflare captchas.

Have you searched for an answer?
Yes, and found this, with no answer, and the problem is obviously still occuring. https://community.cloudflare.com/t/infinite-loop-of-hunan-verification-loop/475275

Please share your search results url:
https://www.google.com/search?q=cloudflare+makes+me+verify+indefinitely&rlz=1C1CHBF_enUS923US923&oq=cloudflare+makes+me+verify+indefinitely&aqs=chrome..69i57.5901j0j4&sourceid=chrome&ie=UTF-8

Describe the issue you are having:
When trying to pass a Cloudflare captcha, it makes me answer it multiple times, sometimes 10+, and I often give up before finding out if it’s infinite or will complete.

What error message or number are you receiving?
None, it just continuously makes me complete a new captcha. Happens on all kinds, the simple click the checkbox seems to be the worst, often with 10+ tries necessary.

What steps have you taken to resolve the issue?

  1. Incognito mode
  2. Bypass proxy for Cloudflare + discord + openai.com
  3. Disable HTTPS proxy entirely.

Was the site working with SSL prior to adding it to Cloudflare?

What are the steps to reproduce the error:

  1. Visit chat.openai.com/chat
  2. Click the captcha checkbox
  3. Repeat 12x until it lets you in (or just asks again to solve the captcha)

Have you tried from another browser and/or incognito mode? Yes, the results are indistinguishable.

Important info:
It seems this started happening after I began using Fiddler as an HTTPS proxy (with the Fiddler cert trusted at the OSA level) for some work I’ve been doing, I believe it also led to discord banning me immediately after solving a Cloudflare captcha…

I have since disabled the proxy on all discord + Cloudflare domains I could think of, but today I still had the issue, even with the proxy fully disabled.

2

It also happened on this page:
https://www.hostpapa.com/knowledgebase/list-useful-commands-manage-exim-mail-server/
Took 6 successful checkbox captchas to get thru -.- this is ridiculous.

Can you please fix this, I’m betting my IP is flagged because i was using a proxy, even though that’s ridiculous, because it was a LOCAL PROXY so it was still only me using my regular IP address.

3

Same problem, stuck in Cloudflare captcha verification.

6

I am also experiencing the same issue on Kumascans

Sometimes the Loop just stops after 4-5 attempts, but on some days I try over 20 times before giving up but it just does not go away.

Refreshing, clearing cache, nothing helps.

7

Fiddler has a known JA3 fingerprint, it’s likely that the bot protection saw that the fingerprint of your connection and the UA didn’t match and flagged you.

I believe Cloudflare doesn’t do this aggressive flagging by default, its likely that the site owner added firewall rules to detect and flag/block Fiddler users.

This is where things get odd, after you disable fiddler, you should be good to go. Can you verify fiddler isn’t running in the BG? I had that happen in the past.

For all the other people that is having issues, can you share the following?

  1. Browser and version.
  2. Do you have any privacy focused extension?
  3. Does the error occur with turnstile or does it happen with any “loading”/“challenge” page?
  4. Can you share some RayIDs where the challenge looped?

@cf1337 @cyandream @nebojsatumbas

8
  1. Chrome, always updating to latest public version imediately (+ I have a separate beta for testing purposes)
  2. AdBlocker and Avast extension
  3. What is “turnstile”??? I seldom recieve the error on the “challenge” page. But it’s always just aa checkbox.
  4. Ray ID: 7aac5a80d8bac314
  5. Ray ID: 7aaca945fb5438b3
  6. Ray ID: 7aacaaccddee38b3
  • 3 times then it went through this time
9

Could you try to replicate the infinite/long loops without the avast extension? I suspect the extension might be spoofing some parameters of your browser that are typically used to flag bots.

10

I would also try removing the “AdBlocker”, as it appears that Chrome and various AdBlock extensions together have shown conflicts like that.

11

A post was merged into an existing topic: Cannot access sites