brave-browser: Cloudflare endless looping due fingerprinting

Description

Visiting the http://chaingames.io/ caused an endless loop for the user

Steps to Reproduce

Open http://chaingames.io/
Expect Cloudflare to redirect
(according to user, didn’t redirect)

Actual result:

d5af81cb6b7c85b50a3cd68f1fbca3f65a763553_2_690x431

Expected result:

Allow cloudflare to work correct (redirect correctly, and not loop)

Reproduces how often:

I wasn’t able to reproduce, was reported via the forums.

Brave version (brave://version info)

Version 1.22.70 Chromium: 89.0.4389.105 (Official Build) (x86_64)

Version/Channel Information:

Can you reproduce this issue with the current release?
Can you reproduce this issue with the beta channel?
Can you reproduce this issue with the nightly channel?

Other Additional Information:

Does the issue resolve itself when disabling Brave Shields? Yes, (Fingerprinting)
Does the issue resolve itself when disabling Brave Rewards?
Is the issue reproducible on the latest version of Chrome?

Miscellaneous Information:

Reported here: https://community.brave.com/t/brave-browser-stuck-on-cloudflare-loop/224513/

I wasn’t able to reproduce this, but logged ticket for followup/confirmation 5b1be1a02b2ee163a46b04675c2806c7e2f219c8 bcdf2ccb791afea13bb94f96e81f52a02722398f

About this issue

Original URL
State: closed
Created 3 years ago
Reactions: 1
Comments: 26 (13 by maintainers)

Most upvoted comments

Just to follow up here, I have an ongoing discussion with Cloudflare folks to sort this out. I hope to have more news to share shortly, but we’re working on it aggressively

pes10k on Apr 19, 2021

My apologies for the slow reply, @pes10k.

I’m connecting from the UK. I’d be happy to share the URLs I’m seeing the issue on, but it actually seems the issue has resolved. I recall that cloudflare.com itself inaccessible, but, I’ve just successfully accessed the website. In addition, a few minutes ago, https://sportsbikeshop.co.uk actually showed the DDOS protection screen for a second before redirecting successfully.

Good news from a practicality standpoint, but perhaps not for issue reproduction! I shall get in touch, though, if I see it again.

Thanks for your assistance with this.

kjkent on May 25, 2022

Verified passed on

Brave | 1.23.73 Chromium: 90.0.4430.85 (Official Build) (x86_64)
-- | --
Revision | 5bc145d831c180d9ff94f29a0d7a2e1cbd30ef36-refs/branch-heads/4430@{#1311}
OS | macOS Version 10.15.7 (Build 19H524)

Verified STR from description. Confirmed I was redirected as expected.

Verification passed on

Brave	1.23.73 Chromium: 90.0.4430.85 (Official Build) (64-bit)
Revision	5bc145d831c180d9ff94f29a0d7a2e1cbd30ef36-refs/branch-heads/4430@{#1311}
OS	Ubuntu 18.04 LTS

15039

Verification PASSED on Win 10 x64 using the following build:

Brave | 1.23.73 Chromium: 90.0.4430.85 (Official Build) (64-bit)
-- | --
Revision | 5bc145d831c180d9ff94f29a0d7a2e1cbd30ef36-refs/branch-heads/4430@{#1311}
OS | Windows 10 OS Version 2009 (Build 19042.928)

LaurenWags on Apr 22, 2021

Just to update everyone on the issue, we were able to sort out the issue with Cloudflare (its a collision between Brave’s fingerprinting defenses and changes in upstream), and its fixed in https://github.com/brave/brave-core/pull/8562. It should hit nightly in the next 24 hours

There are also hot fixes being prepared for Beta and Stable too (see above), which should also land in the next 24 hours.

Thanks very much again for everyone’s help in reporting this and making sure it got sorted!

pes10k on Apr 21, 2021

I still have this issue, same as dimon222, I only get throught by allowing all fingerprints. I’m using it on Mac v1.22.71

Can confirm this. Happens across all Cloudflare DDoS protected sites, including Gitlab’s signin page.

Allowing all fingerprinting (or of course shields down) allows the CF check to pass.

Cheers, Bryan

bryanvaz on Apr 17, 2021

@pes10k

Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

dimon222 on Apr 15, 2021

standard. Only if I put “Allow all fingerprints” the page is able to pass cloudflare’s challenge.

dimon222 on Apr 5, 2021

I’ve reached out to CF to see if we can work things out with them. @ryanbr, could you follow up in the community thread and let them know that we’re trying to work things out with Cloudflare?

pes10k on Mar 31, 2021