23

The Stack Overflow OAuth endpoints (https://stackoverflow.com/oauth/access_token/ and https://stackoverflow.com/oauth/access_token/json) have started responding to requests from the server I run my projects on with 403s and a Cloudflare CAPTCHA page, meaning users are unable to log in. This issue seems very similar to New Cloudflare protection breaking important bots.

Improve this question
9
  • Oddly, using wget to manually POST to the endpoints (from the same server) and providing a browser UA works correctly, returning a JSON error.
    – Ginger
    Commented Feb 9 at 14:45
  • Feels similar to this: stackapps.com/questions/10497/…
    – rene Mod
    Commented Feb 9 at 14:54
  • 1
    A UserAgent that is long enough is needed, indeed.
    – rene Mod
    Commented Feb 9 at 14:57
  • New report on Stack Apps as well: stackapps.com/questions/10513/…
    – rene Mod
    Commented Feb 16 at 7:59
  • This appears to have expanded to the rest of the site as well, unfortunately. I've contacted SE personally, but haven't gotten a response yet.
    – Ginger
    Commented Feb 20 at 15:43
  • Yeah, I status-reviewed the reports on Stack Apps already. Let me check if an MSE mod is around to discuss if adding more status-review tags will help.
    – rene Mod
    Commented Feb 20 at 16:03
  • 7
    I've been informed that the dev-team has the tickets on their board, I've not been given an ETA so it remains a waiting game.
    – rene Mod
    Commented Feb 20 at 18:24
  • Almost "me too!" I have the same problem but with a new personal project. In the meantime, when this issue is solved, I'm experimenting with Auth0. So far, it's working fine for my use case.
    – Rubén
    Commented Feb 20 at 19:30
  • 1
    Possibly related? meta.stackexchange.com/questions/398192/…
    – tripleee
    Commented Mar 2 at 8:50

1 Answer 1

Reset to default
9

Sorry it took a while to get to me and then hunt down the issue but it should now be resolved. Part of the issue is that the managed challenge from Cloudflare was intermittent, making tracking down the root issue difficult.

Improve this answer
5
  • 6
    You really should make an account on Stack Apps. We have plenty of questions for you to answer .... ;)
    – rene Mod
    Commented May 14 at 19:51
  • Does this apply for the network login pages as well? My bots use them to get a chat token, since there's no official API.
    – Ginger
    Commented May 15 at 22:59
  • @Ginger what's the domain / path for the network login your bot is using?
    – Josh Zhang StaffMod
    Commented May 16 at 11:51
  • @JoshZhang The login code is available here, but it effectively runs through the entire SE login process as if it were a human (since that's the only way to get a chat token).
    – Ginger
    Commented May 16 at 12:52
  • @JoshZhang My chatbots are still broken and I'm still getting CAPTCHAs from Cloudflare...
    – Ginger
    Commented Jun 5 at 19:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .