I have a server set up with nginx that's intended to transparently reverse-proxy a specific website that is not owned by me. Recently that website started using Cloudflare DDOS protection and I'm no longer able to access it using nginx.

From what I can tell, what's supposed to happen is that I'll access a page and receive a 503 from Cloudflare with its "DDOS protection" page. That page will then redirect to another URL containing encoded data, my browser receives a 302 response, and that will redirect to the page I'm trying to access.

What's apparently going wrong though when this is proxied through my nginx server is that after the 302 direction, the page I'm trying to access will produce another 503. It will then get into an endless cycle of redirection. Apparently something that Cloudflare is trying to set up is not working, causing my browser to never get past its protection.

I'm still new to nginx and so far I haven't figured out how to fix this.

Here is the nginx server configuration with any identifying information redacted:

server {
    listen XYZ;

    location / {
        proxy_set_header Referer "https://target.website";
        proxy_pass https://target.website/;
        proxy_redirect https://target.website https://$host:$server_port;
        proxy_set_header Accept-Encoding "";
        sub_filter_once off;
        sub_filter 'https://$proxy_host' 'https://$host:$server_port';

Is there something I can change so that it will pass Cloudflare's check?

edit: I have explicit permission from the site's administrators to connect to it using this proxy.


Is there something I can change so that it will pass Cloudflare's check?

If you, the non-owner of this website, could do something to evade CloudFlare's DDOS check, so could the DDOSers. No, you're not likely to be able to evade this without the owner of the website adding an explicit exemption for your access. If you've got a legit reason to be proxying this site, contact them and request assistance.

  • I'm not trying to evade the check. I'm looking to pass it. It's perfectly fine if the website forces me to wait a few seconds before accessing its resources. – GuyGizmo Apr 12 at 18:31
  • Your server is not a human, and will not pass the "are you a human" check as a result. Your server is doing the accessing. – ceejayoz Apr 12 at 18:32
  • There is no "are you a human" check. The DDOS protection page simply causes you to wait about five seconds before accessing the requested page, and is only supposed to happen once. I'm thinking that there's a cookie that's failing to be properly set. – GuyGizmo Apr 12 at 18:33
  • It does quite a bit more than just that. They use JavaScript on that page to verify that you're using an actual browser and not something like nginx or curl. They're likely doing browser fingerprinting and rate limiting as well. Per cloudflare.com/ddos, "a number of additional checks are performed in the background" and "JavaScript [is] required for the tests". – ceejayoz Apr 12 at 18:37
  • 1
    @GuyGizmo If you were actually authorized to do this, the website operator could whitelist your server, or just have you proxy to the IP address of his actual server, bypassing CF entirely. We do not permit questions about unauthorized use and abuse of IT systems. – Michael Hampton Apr 12 at 18:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.