API access via Tor exit nodes restricted by Cloudflare challenge

imputnet / cobalt

best way to save what you love

https://cobalt.tools

GNU Affero General Public License v3.0

16.1k stars 1.32k forks source link

API access via Tor exit nodes restricted by Cloudflare challenge #601

Closed barkoder closed 4 months ago

barkoder commented 4 months ago

bug description

Tor exit nodes completely blocked. Cloudflare challenge.

reproduction steps

Steps to reproduce the described behavior.

$ url=https://www.youtube.com/watch?v=2uqcdh81a4c
curl -s -q -x socks5h://127.0.0.1:9050 'https://api.cobalt.tools/api/json' \
--header 'Accept: application/json' \
--header 'Content-Type: application/json' \
--data \
"{\"url\": \"$url\",
\"aFormat\": \"opus\",
\"isAudioOnly\": true}"

Isn't rate limiting a given exit node IP sufficient? Because CF challenges are a pain!

Thanks!

ihatespawn commented 4 months ago

works for me, there were no challenges or anything

ihatespawn commented 4 months ago

also, what do you need to use tor for

barkoder commented 4 months ago

@ihatespawn Access to the main instance's API through command line over Tor is blocked. Not through Tor Browser Bundle.

Issue title changed to make it more obvious.

wukko commented 4 months ago

tor through command line is suspicious enough for cloudflare to block it, and i kind of understand why. i will not do any changes to security level to prevent abuse, but i'll wait for @dumbmoron's opinion before closing the issue.

dumbmoron commented 4 months ago

i'm ok with cloudflare serving a challenge to tor users, because:

if you are using it in the browser, then it will be able to (eventually.. :/) solve it, and then you can access the API
otherwise, if you need to use it via command line tools, it might indicate that you are automating something to some degree, and it might beg the question whether using Tor for it is a good idea
from our perspective, by using tor you effectively gain access to a pool of around 7000 IPs for free, which, had it not been for the cloudflare challenge, could be used to DDoS cobalt trivially