URL of website

I have enabled l7 ddos protection on my website but I have experienced something strange website loads with this ?cf_chl_jschl_tk
http://example.com/?cf_chl_jschl_tk=andsomelongtext

Did you activate „JS Challenge“?

Yes I have activated js challenge

I have same problem
What’s happening?

I have never experienced something like this before. It’s mostly likely to be cf token or something similar.
But it shouldn’t happen like this because I’m using js challenge form 3 months now.

Same for me, this situation seems to started from yesterday,it’s not good for website

What kind of trouble does ist cause to you?
I can’t see any differences at the moment.

I have 2 problems with it.

  1. Google adsene doesn’t show advertise on this page. (because he didn’t check this page before)
  2. I solved the second problem, doesn’t work site’s search form ()
    I changed to and it’s work now.

The same problem. Please, fix it

Is this a bug or not?
Does this bother anyone?

Each time a site of mine that has the I’m Under Attack mode enabled is accessed, an extra portion of code is added to site URL by cloudflare service, for example http://principiuldivin.md/?cf_chl_jschl_tk=323dbb9f827c57e0c3e242f3991a5e74d01e1e98-1575203991-0-AWjacPfZzDuLbqUG1opknbmiXwjy7w4wVTM4LJuhM2t0r-L3h_Cggwp4eiH0JmJfYR76DcDn7wmT8DgIJNuh6XCTNCMAC60vrB68qreMEQ09ATWunLvU1Dv8Gz9vmjE-9A-vfnXgKSbGcBrv7-N6WeVrk6S6P2cfFm3iPEBtC2mnWdiO5Uhvd5oCLd4uThfWKq2hyH1Htzb3m03QjSoVotEIIi6t10crwEKnPjH5FNmEPGyXUkh-7lnZR6Fmff38BfniOdnUBU3ta8PjCaKgNe8

What kind of code is that in the URL, and is it OK that its there?

Thanks!

I have the same situation?

Help pls ?
https://forum.koswog.com/?cf_chl_jschl_tk=73b577a4d8cc05dd379449fafeaed1fc8ca739a1-1575229288-0-Af4uEhhNVhVR14TwAs7O9E8qu0S8kw324Qdw5E2weooHvZvz0EisiaLfQerGU1SnlB3cta-es6pDjX7AIQhL0QwohW0KKEt5pqtJAPLOdq6aE12-ZbowRzo5_vOf80aO47l_F5m7vL9BARVFFZxtirCGTCGHM3AUqyy0scJCLKgQlo1YTaTvzquYOTzj0n7qHQKfSiSbWpjfD-i8oFUEcucQf2Hppi8b2A9hH7ZYmdfeiBfkXJksnlWmoso4tdTqu5EmtbVM9t5GIPVwJxE0VqU

i also got same problem like this…
all my site link added this extra text ?cf_chl_jschl_tk=blablabla

please anyone can explain what this issue??
is it save or not?

also this look like very anoying…

Hi, engineer on the Firewall team here.

The parameters __cf_chl_jschl_tk__ and __cf_chl_captcha_tk__ are added to the url after a user successfully passes a IUAM/JS Challenge or Captcha, respectively.

This is expected behavior and is indeed a recent change.

Previously, users who got a challenge when submitting a POST form would have to fill and submit it again after passing said challenge. By adding the parameter this is no longer needed, allowing for a better user experience.

Hope this helps!

4 Likes

Well, that’s good to know.
All clear now.
Thanks!

what’s going on??? the website is says Checking your browser before accessing “Ddos attack” exsample.com THEN SITE SHOWS UP Cannot POST /en//

Clients are asking about what is it and why its there. Can this behaviour changed or is it mandatory?

Hi @Snowflare, the parameter will always be added and it is currently not possible to disable it.

I’ve added some additional explanation above at: URL of website.

This recent change has made my pages where I’m using rate limiting to get stuck with the cf_chl_jschl_tk parameter. The “Checking your browser before accessing” runs forever. It’s only when I reload the page (and be forced to Confirm Form Resubmission, and no form was sent before actually) that the page loads.