[Website] Cloudflare turnstile never passes

[CarrotStew]

Hello, I notice on a few webpages that the turnstile check for bots never passes for the brave browser, and instead sends me into an infinite loop. Anti-bot metrics dashboards have been found to be... unreliable to put it generously in terms of reporting failures, so It's good to make sure this is known.

What did you do?


go to a page with a turnstile (ucp.php?mode=ybtva&redirect=index.php) while using the Brave browser (stock is fine) while on a VPN (PIA in my case),
a turnstyle challenge will appear when you attempt to log in.

What happened?

the turnstile will process for a few moments then fail. a new one will pop up, indicating you should try again, you may click this as many times as you like, but it will never pass.

What did you expect to happen instead? It might be obvious to you, but do it anyway!

I expect the turnstile to pass.

Does it happen always, once, or sometimes?

once the cloudflare turnstile is passed once, and the cookie is injected, the problem goes away until the cookie expires. It will repeat when the expiration happens however.

[Sanqui]

Of course, we would like all legitimate users to have access to our websites, and I'm personally unhappy that we have to put up measures like this, but in particular our phpBB and MediaWiki instances have really struggled with bot traffic. I have investigated if I can do anything about your situation. We don't have any custom rule for forum UCP pages. This particular block may be the consequence of Cloudflare's "Super Bot fight mode", which is "included with your Pro subscription", "always active" and "cannot be customized" (?)... Nevertheless, if you could post your User Agent (via a private message if you want privacy), we could try adding an exception somewhere, just to see if it works.