23

My question got closed as a duplicate as another one. I'd have cast the duplicate vote myself but the bug the post is about prevented me from doing so. But anyway.

Apparently all the GET and POST requests are returning with 403 forbidden messages. And a comment blames Cloudflare for this somehow. And something about an anti-bot system.

But I'm not sure what any of this really means, other than that in practice, it's keeping the site from working properly for us Tor users.

But what exactly is Cloudflare? Can someone explain to me what is going on like I'm five? And what technical changes caused this bug that did not used to occur occur now? And why does it only affect Tor users? Can someone give some technical insight and put it in layman's terms?

Edit: Here is something else I do not understand. What I think is happening based on my interpretation of the answer is that Stack Exchange was put behind Cloudflare to block illegitimate requests as a result of a DDoS attack or something. But my question is, why is Cloudflare blocking some types of requests (flag, vote to close, open inbox, open achievements) but not others (ask questions, edit posts)?

Another Edit: How is Cloudflare blocking the JS files? Is it blocking them from being downloaded to the client, or is it blocking any requests that happen to be made from a JavaScript file? And how would it know?

3
  • 2
    From what I understand, SE tightened security using Cloudflare tools, it also has something to do with switching CDN (which host static files to reduce page load times) but didn't get how exactly. The tightened security results, naturally, in great many legit requests blocked, so SE twist the settings, and adding IP ranges to "allow lists" etc, and thus allowing most legit requests through. Why they won't do that for Tor, not sure, probably because too many spammers use it. Again, all of this might be wrong hence just a comment. Hopefully staff member who knows will come over and explain. Commented Oct 12, 2023 at 8:04
  • 10
    We have shared some info about this but it's been in comments. I've talked with some people internally and we'd like to share the explanation for this since we've seen some people thinking that this is intentional and we're trying to block ToR users, which is not the case. :)
    – Catija
    Commented Oct 12, 2023 at 14:08
  • 2
    Regarding the edit, what's being blocked are the JS files. Stack Exchange sites are built in a way that one can do the basic things even without JS at all, so that's why you can do the basic actions like asking or answering, even when all JS files are blocked. Commented Nov 27, 2023 at 7:09

1 Answer 1

24

There are a couple of different things at play in this case, but since it involves Tor, I'll expand the answer to cover some other questions that were asked.

With the switch to Cloudflare as our CDN, access to Stack Exchange network sites from Tor actually became faster due to Cloudflare's infrastructure on the Tor network. Cloudflare however treats Tor traffic with more scrutiny than normal internet traffic, as a lot of attacks originate from there.

To defend against DDoS and other attacks from Tor, Cloudflare's web application firewall will flag some traffic from Tor as malicious, and they use various techniques to do this. One such example is cross referencing the source address to FireHOL. When Cloudflare suspects a request to be malicious, a managed challenge is presented and if the challenge isn't solved, it will result in a block.

Another issue is Cloudflare's use of IPv6 on the Tor network. This causes some things to simply not work due to our application not supporting IPv6 yet. The most visible manifestation of this is the top bar not working.

We've implemented as many workarounds as possible without outright blocking IPv6 traffic as it will take time to implement IPv6 support. In the interim, users can try adding ORPort 443 IPv4Only to their torrc file to try and force IPv4 connections through Tor, but this still has mixed results from our testing.

2
  • Adding ORPort 443 IPv4Only to my torrc file worked, but only on Meta, not on other sites, odd. Commented Dec 4, 2023 at 1:46
  • Possible explanation: Cloudflare is often used for caching of static content, if you've already cached that content then you won't get the related issue. Commented Jan 28 at 0:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .