Access Blocked by Cloudflare WAF

[ximellon]

Due to heavy load from certain area, e.g. Asia, danbooru site's admin has turned on WAF (Web Application Firewall) as a solution to non-human accesses. But this also affects third-party apps' normal workflow. For example, in Boorusama, it'll report Something went wrong and stop working. Glad that other apps' developers have solved this problem:

• https://github.com/flexbooru/flexbooru/commit/80fc0c44206991bbfe7a9ae5320c4b1b4a70cf5f
• https://github.com/flexbooru/flexbooru/commit/f50807cc90c79a00183337e08b1d5a61a8b30ab5
  • https://github.com/tachiyomiorg/tachiyomi/blob/master/core/src/main/java/eu/kanade/tachiyomi/network/interceptor/CloudflareInterceptor.kt

Hope you can add this exception handling to this app, which, in my opinion, is the best app for accessing danbooru by far.

[khoadng]

Thanks for reporting this issue. I'll take a look.

[khoadng]

Could you tell me the steps to reproduce this problem?

[ximellon]

https://github.com/flexbooru/flexbooru/issues/200

Here are the details that I previously left on Flexbooru. Hope this would help you reproduce this problem.

[khoadng]

@ximellon I can reproduce it by changing my IP to Japan yesterday. But the problem seems to go away today for some reason. I don't know if Danbooru removes the Cloudfare layer or not.

Could you help me verify if the app is working on your side?

[ximellon]

Yes. It did work normally now. But WAF did exist when I access Danbooru this morning, which is about 10 hours ago. I think it might not completely gone since when I started to use Boorusama, like 1 month ago, it did work without any problem. However, as I read from forum of Danbooru, WAF should have been enabled for months (pretty sure they added it in the first half of this year to reduce crwalers' accesses for AI drawing training). And on the next day, BOOM, this error stared to bother me until now. So it might depends on some condition setup, somtimes WAF just thinks you are harmless. I believe it's temporary and I'll report at this thread when I meet WAF next time.

BTW, I go out with Taiwan IP.

[khoadng]

I see usually these kind of errors are pretty hard to fix if you can't reproduce it consistently. For now, I will try to make some changes to show a specific error message instead of a general unhelpful one.

[khoadng]

@ximellon So this is the reason why Japan IP got hit with WAF, does Taiwan IP still having issues?

[ximellon]

Nope. Totally fine today as well. Guess they treated us as a whole region. Or maybe all apps share the same internal cookie and this problem fixed by Flexbooru (I used it before)?

[khoadng]

maybe all apps share the same internal cookie

I don't think this would be the case since it is a major privacy violation to have this kind of data shared between apps.

I guess Danbooru admins not only removed restrictions for Japan but some other countries as well, but they didn't mention it.

Anyway, I will close this issue for the time being, feel free to reopen it if they add WAF again.