Reply to thread

Message

<blockquote data-quote="BIOS" data-source="post: 461776" data-attributes="member: 15674">They can bypass Cloudflare js-challenge, not the real CAPTCHA (and that's because js-challenge is literally just asking the client to compute a basic math equation in JS, shouldn't ever really be depended upon). You can use 5 firewall rules on CF for free (and set them to CAPTCHA or block all together if you're confident of no false positives), and then configure rate limiting on your own server e.g. <a href="http://nginx.org/en/docs/http/ngx_http_limit_req_module.html" target="_blank">NGINX</a>, for anything that gets past those rules.Adding a CAPTCHA to the site wouldn't really do a lot in this case. Sure it'd maybe stop bots being able to login and access other areas of your site, but ultimately you'd still end up processing all the malicious requests at your origin (seen 25M+/day in some cases), chances are you'd still get knocked offline pretty quickly from them hammering your CAPTCHA page, especially without tuning the server or adjusting connection hard limits.</blockquote>

[QUOTE="BIOS, post: 461776, member: 15674"] They can bypass Cloudflare js-challenge, not the real CAPTCHA (and that's because js-challenge is literally just asking the client to compute a basic math equation in JS, shouldn't ever really be depended upon). You can use 5 firewall rules on CF for free (and set them to CAPTCHA or block all together if you're confident of no false positives), and then configure rate limiting on your own server e.g. [URL='http://nginx.org/en/docs/http/ngx_http_limit_req_module.html']NGINX[/URL], for anything that gets past those rules. Adding a CAPTCHA to the site wouldn't really do a lot in this case. Sure it'd maybe stop bots being able to login and access other areas of your site, but ultimately you'd still end up processing all the malicious requests at your origin (seen 25M+/day in some cases), chances are you'd still get knocked offline pretty quickly from them hammering your CAPTCHA page, especially without tuning the server or adjusting connection hard limits. [/QUOTE]

Verification

Reply to thread

Connect with us

Newest members