Endless challenge at Cloudflare Verification

[aliafshany]

AdGuard version

Version 2.10.1.1277 nightly

Browser version

Version 0.103.0 (38794), chrome Version 113.0.5672.92 (Official Build) (arm64)

OS version

ventura 13.3.1

What filters do you have enabled?

AdGuard Annoyances filter, EasyList, Adblock Warning Removal List, Online Malicious URL Blocklist, Iranian filter

What Stealth Mode options do you have enabled?

No response

Support ticket ID

No response

Issue Details

Steps to reproduce:

1. go to a site that has a Cloudflare anti-robot verification like vultr.com, ping.pe
2. you would check the checkbox over and over but it won't verify you.
3. turn AG totally off and then refresh the page and verify that, It woks then!

Expected Behavior

Cloudflare won't verify you.

Actual Behavior

Cloudflare won't verify you unles you turn AG off

Screenshots

cf.mp4

Additional Information

No response

[aliafshany]

my settings in Adguard:

AG.mp4

[ZeroClover]

Same here.

After repeated testing, I found that keeping the following AdGuard Stealth Mode features disabled avoids this issue:

• Block Push API
• Block Location API
• Block Java
• Hide your User-Agent
• Remove X-Client-Data Header

I have set one of my test sites to always return to the challenge page (interactive challenge) to facilitate testing.

https://turnstile.zeroclover.io/

[aliafshany]

@ZeroClover
thank you for testing and sharing the results.

Unfortunately, Block Location API and Block Java are important for me to hide any IP leaks that might occur.
Hope the Devs find a good solution for this.

[Aydinv13]

@aliafshany @ZeroClover Hi, sorry for the late reply.

Most likely Cloudflare is asking you to enter captcha/wait because the User-Agent is incorrect or typed in by hand - that's a reason to be suspicious. Such User-Agent will not match the TLS fingerprint with the browser, therefore there may be issues such as endless checks.

[ZeroClover]

@Aydinv13

User-Agent is part of the reason for this issue, but not the decisive factor.

Even without disguising the User-Agent, blocking access to a browser's Push/Location/Java API will cause Cloudflare to endlessly challenge.

Cloudflare CAPTCHA (Turnstile) uses browser fingerprints and functions to identify legitimate users and bots. Unfortunately, most pre-compiled headless browsers (widely used by crawlers) do not implement the aforementioned APIs mentioned above.

[Aydinv13]

Issue moved to AdguardTeam/CoreLibs #1765 via Zenhub