```[cors] 2023/02/02 14:36:53 Handler: Actual requ...
# ory-networkd
damp-football-37528
02/02/2023, 1:02 PM Copy code
[cors] 2023/02/02 14:36:53 Handler: Actual request
[cors] 2023/02/02 14:36:53 Actual request no headers added: missing originf
famous-art-85498
02/02/2023, 1:03 PMHey, Cloudflare detected your traffic as malicious and blocked the request with a challange
famous-art-85498
02/02/2023, 1:03 PM Copy code
Depending on the characteristics of a request, Cloudflare will choose an appropriate type of challenge, which may include but is not limited to:
A non-interactive challenge page (similar to the current JS Challenge).
A custom interactive challenge (such as click a button).
Private Access Tokens (using recent Apple operating systems).
A CAPTCHA challenge.d
damp-football-37528
02/02/2023, 1:04 PMthere is nothing interactive on the page :I
f
famous-art-85498
02/02/2023, 1:04 PMOWASP Core Ruleset activated it and the rule inbound Anomaly Score Exceeded was trigerred
d
damp-football-37528
02/02/2023, 1:04 PMi guess the localhost callback is triggering those :E
f
famous-art-85498
02/02/2023, 1:04 PMthe non interactive challanage might got used
d
damp-football-37528
02/02/2023, 1:05 PMok, there are no instructions to do anything, i dont get what to do
damp-football-37528
02/02/2023, 1:06 PM Copy code
<http://xxx.projects.oryapis.com|xxx.projects.oryapis.com>
Checking if the site connection is secure
<http://xxx.projects.oryapis.com|xxx.projects.oryapis.com> needs to review the security of your connection before proceeding.
Ray ID: 793323a74f84d922
Performance & security by Cloudflaredamp-football-37528
02/02/2023, 1:06 PMim inspecting the page and see nothing
f
famous-art-85498
02/02/2023, 1:06 PMcan you leave the website open for a moment?
famous-art-85498
02/02/2023, 1:07 PMCloudflare defines for ex JS Challange as follows :
Copy code
JS challenge
With a JS challenge, Cloudflare presents challenge page that requires no interaction from a visitor, but rather JavaScript processing by their browser.
The visitor will have to wait until their browser finishes processing the JavaScript, which should be less than five seconds.d
damp-football-37528
02/02/2023, 1:07 PMseems it fails to load the challenge code... 404
damp-football-37528
02/02/2023, 1:08 PM*ray:* 793323a74f84d922damp-football-37528
02/02/2023, 1:08 PMugh
damp-football-37528
02/02/2023, 1:09 PMseems the day in the query is same as printed on the page, so that wont probably help you
damp-football-37528
02/02/2023, 1:10 PMso its still trying to fetch the challenge throug the proxy domain
Copy code
<http://localhost:4000/cdn-cgi/challenge-platform/h/b/orchestrate/managed/v1?ray=793329830ef2df68>damp-football-37528
02/02/2023, 1:10 PMwonder why its 404:ing
f
famous-art-85498
02/02/2023, 1:10 PMhaha 😄
d
damp-football-37528
02/02/2023, 1:11 PMother stuff fails too 404
<http://localhost:4000/cdn-cgi/styles/challenges.css>damp-football-37528
02/02/2023, 1:11 PMany ideas?
f
famous-art-85498
02/02/2023, 1:11 PMyes, because proxy does not have those assets
famous-art-85498
02/02/2023, 1:11 PMwhat do you run locally?
d
damp-football-37528
02/02/2023, 1:12 PMso this challenge would only work in prod with your slug domain or a customr CNAME domain
f
famous-art-85498
02/02/2023, 1:12 PMand try to clear website data for now in your browser
d
damp-football-37528
02/02/2023, 1:12 PMgo server, using self service browser login, when hitting microsoft button
damp-football-37528
02/02/2023, 1:13 PMand
ory proxy <https://localhost:4443> --dev --debug --project <slug>damp-football-37528
02/02/2023, 1:13 PMlocalhost is running self signed cert, which is installed to chrome so it should be a-ok
damp-football-37528
02/02/2023, 1:14 PMwodner if its hitting the security scans becase the query callback is https://localhost :E
damp-football-37528
02/02/2023, 1:14 PMi know the OWASP can snoop all kinds of things like url/query and bodies too
damp-football-37528
02/02/2023, 1:15 PM@chilly-sandwich-92462 maybe you could proxy those cloudflare things in ory proxy to fix this bug
damp-football-37528
02/02/2023, 1:16 PM Copy code
/cdn-cgi/styles/challenges.css
/cdn-cgi/challenge-platform/h/b/orchestrate/managed/v1?ray=793329830ef2df68
/cdn-cgi/images/trace/managed/js/transparent.gif?ray=793329830ef2df68damp-football-37528
02/02/2023, 1:18 PMI cant imagine me being the first one to encounter this with ory proxy in dev mode? its the only way to run this self service stuff while developing as i understand it, so everyone should be doing this and having the return_to callback to localhost
damp-football-37528
02/02/2023, 1:20 PMoh damn, clearing cookies and disabling network cache fixed it
damp-football-37528
02/02/2023, 1:21 PMwonder whyt that would make me not "malicious" again
damp-football-37528
02/02/2023, 1:22 PMthere were at least two cookies with
__cff
famous-art-85498
02/02/2023, 1:25 PMWe are discussing the change in proxy but this is not a proper fix, we need to get in touch with CF and report that
d
damp-football-37528
02/02/2023, 1:26 PMwould think those asset URL should be absolute pointing to cloudflare, not relative to current host
f
famous-art-85498
02/02/2023, 1:26 PMcause cloudflare cookies should not trigerr cd itself to block
d
damp-football-37528
02/02/2023, 1:27 PMhopefully this cant happen in prod in the real domain (yours or customer custom CNAME domain)
damp-football-37528
02/02/2023, 1:27 PMwould mean our end users might see this error page
f
famous-art-85498
02/02/2023, 1:27 PMwe haven’t deployed changes in cf, we need to report it to them
d
damp-football-37528
02/02/2023, 1:27 PMi recon the challenge will indeed load there, but still a bit scary for end users
f
famous-art-85498
02/02/2023, 1:27 PMsorry for inconvinience
d
damp-football-37528
02/02/2023, 1:28 PMaight, no problem. lets see if it happens again in the future
3 Views