By @B00H0. Updates on Telegram: @HK407.
Solves Cloudflare's silent JSD challenge natively in Go (no browser, no JS engine). Fetches the
page, scrapes __CF$cv$params, deobfuscates the JSD script, builds the fingerprint payload,
LZ-compresses it, and POSTs the oneshot to mint cf_clearance. One ~zero-dependency binary,
hands you back the cookie jar + UA for replay.
cf_clearance is IP + User-Agent bound. Solve through the same proxy you'll replay with.
For managed challenges or Turnstile, check my other repo: cloudflare-solver.
$ curl -X POST http://localhost:8191/solve \
-H "content-type: application/json" \
-d '{"url":"nowsecure.nl"}'
{"success":true,"elapsed":726,"status_code":200,"cf_clearance":"uEA9MPOC3maj85MUYENhuS4X3KX4...","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36"}
Requires: Go 1.25+. No Chrome needed.
go build -o jsd_solver.exe .
./jsd_solver.exe
API is on http://localhost:8191 by default.
{"url":"nowsecure.nl","proxy":"http://user:pass@host:port"}| Field | Required | Description |
|---|---|---|
| url | yes | Target URL. No scheme means https:// is added. |
| proxy | no | http://user:pass@host:port, socks5://..., or host:port:user:pass |
| mode | no | See modes below. Default full. |
| profile | no | tls-client profile. Default chrome_146. |
| timeout | no | Per-request timeout in seconds. Default 30. |
GET / returns service info + config.
| mode | Returns |
|---|---|
full (default) |
cf_clearance, cookies, cookie_header, user_agent |
clearance |
cf_clearance, user_agent |
cookies |
cookies, cookie_header, user_agent |
headers |
headers (final response headers) |
user_agent |
user_agent |
Aliases: cookie to cookies, header to headers, ua to user_agent, token to clearance, all to full.
{
"success": true,
"elapsed": 726,
"status_code": 200,
"cf_clearance": "uEA9MPOC3maj85...",
"cookies": {"cf_clearance": "...", "__cf_bm": "..."},
"cookie_header": "cf_clearance=...; __cf_bm=...",
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) ... Chrome/148.0.0.0 Safari/537.36"
}Optional .env file in the working directory. All have defaults.
| Variable | Default | Description |
|---|---|---|
| PORT | 8191 | HTTP port |
| LISTEN_HOST | 127.0.0.1 | Bind address (0.0.0.0 = all) |
| MAX_CONCURRENT | 50 | Parallel solves |
| TIMEOUT_SEC | 30 | Per-request timeout |
Each solve is ~0.7-2.5s (network-bound). Deobfuscation is ~3ms. Throughput is roughly concurrency / latency:
| MAX_CONCURRENT | @ ~1.2s latency |
|---|---|
| 25 | ~1,250 / min |
| 50 (default) | ~2,500 / min |
cf_clearance is IP-bound, so high volume needs a rotating proxy pool. Measure with:
go run ./cmd/jsdctl loadtest -url https://www.flytap.com/en-us -c 40 -d 60 -proxies proxies.txt
If /solve returns deobfuscation error: failed at step N, Cloudflare changed the JSD script. Fetch a fresh one and inspect:
go run ./cmd/jsdctl fetch https://www.flytap.com/en-us # saves debug_script.js
go run ./cmd/jsdctl deobf debug_script.js # prints which step failed
The first step that prints empty/0/ERROR points to what to fix in visitors/deob.go.
MIT. See LICENSE.