When I finish Cloudflare challenge, the captcha.wetsite show me the Privacy Pass homepage and get no tokens

[zanderpeng]

operating system： windows 2019
Web browser :chrome 98.0.4758.102
Extension version：3.0.1
Problem description：
When I finish Cloudflare challenge, the captcha.wetsite show me the Privacy Pass homepage and get no tokens

[RealDolos]

Can confirm, Chrome and Firefox affected, so it's not a browser-specific problem.
@ppopth you fixed it last time in #291 / #292 and the symptoms now seem identical, except it affects the latest 3.0.1

Diagnosis

QUALIFIED_BODY_PARAMS contains cf_captcha_kind as a required parameter for detection, however that parameter is not actually issued with requests anymore. Thus the extension fails to detect captcha response requests and subsequently fails to convert these requests into token issuance requests and get tokens issued.

Removing the cf_captcha_kind requirement, or replacing it for something that exists, like captcha_answer fixes the problem and makes the extension work again; tokens become available and also are used when needed.
The other checked parameter, h-captcha-response, still exists in the requests and is therefore not a problem for now.

In general, the whole detection code seems to be terribly fragile, if it breaking twice in as many weeks is any indication. It would be good if the cloudflare captcha team could establish a formal way of detecting such requests that the cloudflare privacy pass team could use.

[ppopth]

Thank you for reporting. The issue will be solved by #308

[warren-bank]

fwiw, I just retested the most recent release of the extension built from PR #283 ..and it still works correctly (with a few documented caveats). This version was built nearly 3 weeks ago, as the PR hasn't received any recent feedback. Maybe somebody could take a look at its code.. and we could merge some of its many updates?

[zanderpeng]

I just test version：2.0.7,in this version hcaptcha is work, I get tokens.But Cloudflare still can't work.
By the way，which version is work？ where I can find it for chrome

[tumagonx]

fwiw, I just retested the most recent release of the extension built from PR #283 ..and it still works correctly (with a few documented caveats ). This version was built nearly 3 weeks ago, as the PR hasn't received any recent feedback. Maybe somebody could take a look at its code.. and we could merge some of its many updates?

Thanks your fork works!
tested version 3.6.6 on Windows XP, Chrome 78, Tor 0.3.5.10

[zanderpeng]

fwiw, I just retested the most recent release of the extension built from PR #283 ..and it still works correctly (with a few documented caveats ). This version was built nearly 3 weeks ago, as the PR hasn't received any recent feedback. Maybe somebody could take a look at its code.. and we could merge some of its many updates?

Thanks your fork works! tested version 3.6.6 on Windows XP, Chrome 78, Tor 0.3.5.10

when I test 3.6.6 on Windwos 2019 , Chrome 98, it show me this

[warren-bank]

@zanderpeng

• you tried to install a crx2..
  • wrong!
• recent versions of Chrome only support crx3..
  • please try again using the correct format

---

I suppose that I should also (preemptively) make the comment that my releases are self-signed.. and not verified by Google or Mozilla. I use SRWare Iron.. which is available in a portable format, and doesn't require extensions to be signed by a marketplace. Firefox dev works too ^[1]. All other browsers are YMMV.

• ^[1] about:config
  • xpinstall.signatures.required = false

[zanderpeng]

actually,I try both of crx2 and crx3. but they have the same question

[warren-bank]

trying to reproduce..

• decompressed a fresh copy of Google Chrome 98.0.4758.102 portable
• chrome://extensions
  • developer mode = false
    • crx3 does not install
    • package is invalid: CRX_REQUIRED_PROOF_MISSING
  • developer mode = true
    • crx3 installs
    • package is permanently disabled because it isn't verified by Google
  • developer mode = true
    • unpacked crx3 installs
    • package is enabled
    • extension is fully functional

conclusions..

• Chrome: unzip the crx3 into an empty directory, and install the directory as an unpacked extension
• SRWare Iron: ftw

[tumagonx]

I use crx2, and since Chrome (360 EE) is run as Guest user, all of my extensions are in developer mode.

[warren-bank]

according to this Chrome changelog, version 73.0.3683 is when Chrome ended support for installing crx2 extensions; this and all subsequent versions of Chrome only allow crx3.

[warren-bank]

I'm back to using SRWare Iron 85 now.. and just tried to install the crx2;
it refuses with the error: CRX_HEADER_INVALID
..which basically just means that it requires a crx3 instead.

[tumagonx]

oops sorry I have 2 chrome 69 and 78, this one us 69 :D

[warren-bank]

fun fact..

since the crx2 extension is expected to be used in older browsers,
which will be using a javascript engine that doesn't support all modern language features;
the crx2 extensions that I release:

• are fully converted to ES5
• include the core-js polyfill library

I've successfully tested it in Chrome v30:

• hCaptcha works perfectly
• Cloudflare's website doesn't work in this browser,
  but the extension appears to be fully functional