Cannot earn passes on hCaptcha Privacy Pass web page

[BTCAlchemist]

Describe the bug
The Privacy Pass web page to earn new passes (https://www.hcaptcha.com/privacy-pass) does not load the widget to earn passes.

To Reproduce
Steps to reproduce the behavior:

1. Go to https://www.hcaptcha.com/privacy-pass
2. Scroll to "Getting started" section. There is no hCaptcha checkbox under "Once you've got the extension installed, click here (or on any hCaptcha-using website) to earn passes:" Here is a screenshot:
   

Expected behavior
The hCaptcha check box would load

System (please complete the following information):

• OS: Windows 10
• Cloudflare tokens or hCaptcha tokens? hCaptcha
• Browser [e.g. chrome, firefox] Chrome and Brave
• Browser Version [e.g. 79, 80, ] Brave 1.28.105
• Privacy Pass Version [e.g. 2.0.4, 2.0.5 ] 2.0.9
• Did you install Privacy Pass from this repository or from the browser store? Store

[k1ng440]

https://puu.sh/I4TAy/3de6663971.png

[BTCAlchemist]

https://puu.sh/I4TAy/3de6663971.png

Looks like @k1ng440 is having this issue as well. @ppopth Could you help?

[gmt2001]

Some web developer console messages to help with this (Firefox 91.0.1)

Content Security Policy: Ignoring “'unsafe-inline'” within script-src or style-src: nonce-source or hash-source specified
Content Security Policy: Couldn’t parse invalid host 'unsafe-hashes'
Content Security Policy: Couldn’t process unknown directive ‘prefetch-src’
Loading failed for the <script> with source “https://accounts.hcaptcha.com/1/api.js?hl=en&endpoint=https%3A%2F%2Fhcaptcha.com”. privacy-pass:18:1
Content Security Policy: The page’s settings blocked the loading of a resource at https://accounts.hcaptcha.com/1/api.js?hl=en&endpoint=https%3A%2F%2Fhcaptcha.com (“script-src”).
Content Security Policy: The page’s settings blocked the loading of a resource at inline (“style-src”).

[ignat980]

Same issue here!

[ppopth]

Thank you for the report. I'm looking at it. I will get back here soon.

[ppopth]

It seems like hCaptcha just added the json body to their checkcaptcha request. Previously, it has no body and we sent the blinded tokens as a post param in the body of such request.

I'm contacting hCaptcha now. Please also let me know if hCaptcha is also reading this comment

[armfazh]

cc @durch (hCaptcha)

[AstralDestiny]

Got some then when trying to get more it used a pass instead and very quickly told me I wouldn't be able to get more until it all ran out it seems.

[gmt2001]

As of today, this appears to be resolved on Firefox 91.0.2 with plugin version 2.0.9. It took 2 tries, but I was able to get my 5 hCaptcha passes

[ppopth]

@gmt2001 I tried many times until I can get passes. I think I'm going to make it always work before marking this issue as resolved.

[ppopth]

It seems like hCaptcha just added the json body to their checkcaptcha request. Previously, it has no body and we sent the blinded tokens as a post param in the body of such request.

My previous comment as quoted above may be wrong. I just noticed that with the extension installed the browser sends 2 checkcaptcha requests instead of 1 request: one is for sending the captcha answer and one is for issuing the passes.

I'm not sure why hCaptcha really needs 2 requests in this case. The protocol should have only one request.

I think it's good to document the protocol for hCaptcha somewhere

[durch]

Hi folks! Apologies I’ve missed the original notification. We’ll go over our implementation internally and see if we can make improvements to get it to full protocol compliance. Will keep you posted

[e271828-]

This is working for me on FF and Chrome. Seems like a stale issue.

[BTCAlchemist]

It just worked for me on Brave browser. I wouldn't say this is a stale issue, but it appears to have been fixed today. Is anyone else available to test it?