Bug 487303 - plasma-brower-integration causes Cloudflare to lock out humans
Summary: plasma-brower-integration causes Cloudflare to lock out humans
Status: RESOLVED FIXED
Alias: None
Product: plasma-browser-integration
Classification: Plasma
Component: Chrome (show other bugs)
Version: unspecified
Platform: Other Linux
: NOR normal
Target Milestone: ---
Assignee: Kai Uwe Broulik
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-05-20 22:53 UTC by Dominik Kummer
Modified: 2024-09-10 10:38 UTC (History)
8 users (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Dominik Kummer 2024-05-20 22:53:51 UTC
Actually Cloudflare (as gitlab sentinel) classifies me as a robot with Falkon (QtWebengine) but during research I stumbled over this discussion: https://gitlab.com/gitlab-org/gitlab/-/issues/421396#note_1912051035
Comment 1 Dominik Kummer 2024-05-20 23:58:42 UTC
I can confirm now that the Chromium Plasma Integration Extension causes Cloudflare to classify me as non-human.
Comment 2 Fabian Vogt 2024-05-21 07:12:45 UTC
I'm using vivaldi 6.5 here. On gitlab.com I get the cloudflare human verification prompt both without and with p-b-i and checking the checkbox works as expected.
Comment 3 Miguel Guthridge 2024-05-21 08:09:21 UTC
I am also experiencing this issue.

Platform: Fedora 40 Linux (Gnome, extension installed because I distro-hop)
Browser: Firefox Developer Edition (v127.0b3), installed through COPR, did not happen in regular Firefox
Site: https://support.image-line.com/action/login (may need to load page by clearing site data then hitting the login button in the top right)

I've contacted the site owners and am hoping they can provide more details by checking my RayID in their Cloudflare logs.
Comment 4 Miguel Guthridge 2024-05-21 08:22:20 UTC
Site owners responded, saying that the only meaningful information was that the browser "pushed a managed challenge". Not 100% sure what this means or how it is impacted by the extension, but definitely worth investigating.
Comment 5 dofficialgman 2024-05-21 20:02:38 UTC
Also experiencing this issue on all (chromium) browsers that I have the extension enabled on, regardless if actually running on Linux.
Comment 6 Bug Janitor Service 2024-05-22 11:38:17 UTC
A possibly relevant merge request was started @ https://invent.kde.org/plasma/plasma-browser-integration/-/merge_requests/127
Comment 7 Fabian Vogt 2024-05-22 12:44:48 UTC
It's the mpris media sessions integration, to be precise the document.createElement override.

Even just

document.createElement = function() { return Document.prototype.createElement.apply(this, arguments); }

breaks it so I'm not sure what can be done there.
Comment 8 Ken 2024-05-23 22:36:25 UTC
Confirm the same issue using Brave browser with KDE Plasma Integration v1.9.  Turnstile works fine on the same machine using Firefox and works fine on Brave when Plasma Integration extension is disabled.
Comment 9 Ken 2024-05-23 22:37:59 UTC
(In reply to Ken from comment #8)
> Confirm the same issue using Brave browser with KDE Plasma Integration v1.9.
> Turnstile works fine on the same machine using Firefox and works fine on
> Brave when Plasma Integration extension is disabled.

PS - Issue only started recently (this week).  Have been using Brave with Plasma Integration for years without prior Turnstile issue.
Comment 10 Bug Janitor Service 2024-05-24 07:48:41 UTC
A possibly relevant merge request was started @ https://invent.kde.org/plasma/plasma-browser-integration/-/merge_requests/128
Comment 11 ShellWen 2024-05-25 05:05:58 UTC
I can't reproduce this question today, even though it existed yesterday. The environmental check can now be passed straight away. Any more reports on this?
Comment 12 Dezheng He 2024-05-25 14:03:28 UTC
I discovered this issue no later than the 18th of this month and it seems to have been fixed by Cloudflare now
Comment 13 Kai Uwe Broulik 2024-05-25 14:07:43 UTC
Git commit ee2584eca783947a5013d8a7ff15a492dc6b357b by Kai Uwe Broulik.
Committed on 25/05/2024 at 14:06.
Pushed by broulik into branch 'master'.

Namespace custom event types

They can clash with website otherwise.

M  +4    -4    extension/content-script.js
M  +5    -5    extension/page-script.js

https://invent.kde.org/plasma/plasma-browser-integration/-/commit/ee2584eca783947a5013d8a7ff15a492dc6b357b
Comment 14 Dominik Kummer 2024-05-26 12:46:02 UTC
(In reply to Dezheng He from comment #12)
> I discovered this issue no later than the 18th of this month and it seems to
> have been fixed by Cloudflare now

QWebengine is still non-human to Cloudflare. But thats another story. But I am glad Cloudflare finally took action within a few days as soon as KDE community got involved.
Comment 15 Dominik Kummer 2024-09-10 10:38:09 UTC
cloudflare now lets me access gitlab login again.