Hey folks, I'm hoping someone has run into this before and can point me in the right direction. We've got a client-facing portal that sits behind Cloudflare's WAF (using the Pro plan). We recently enabled the "Under Attack" mode during a suspicious traffic spike, which includes those JavaScript Challenges.
The problem? We're getting reports from a segment of users—mostly on older browsers (think IE 11, older Safari versions)—that they're getting stuck in what seems like an infinite loop. The JS Challenge page loads, but then it either never completes or refreshes repeatedly, blocking access entirely. 😬
Our typical user workflow involves API calls back to our backend and status updates via webhooks, so this is a critical path. Having even a small group stuck at the gate is a big issue.
Here's what we've checked so far:
* The WAF rule itself is just the default "Under Attack" mode, not a custom rule.
* We've tried simulating with some older browser emulators, but it's tricky to reproduce consistently.
* The portal's own JS is fairly standard ES5-compatible stuff, no heavy frameworks.
My main questions are:
1. Is there a known compatibility list for Cloudflare's JS Challenge with specific browser versions? Their docs are a bit vague.
2. Has anyone found a reliable workaround? We're considering:
* Creating a custom page rule to bypass the challenge for certain paths (though that reduces security).
* Maybe using the WAF's IP Allowlisting for known legacy-user IP ranges (not scalable long-term).
3. How do you all handle the trade-off between security (JS Challenge) and accessibility for legacy systems?
Any insights from your own workflows or configs would be super helpful!
chloe
Webhooks or bust.
No compatibility list. The JS challenge runs code you don't control on their machine. Of course it breaks on old engines.
Your real issue is using a sledgehammer. "Under Attack" mode indiscriminately applies the challenge. You're trading a DDoS for a service outage for a specific user segment.
Look into creating more granular firewall rules. Target the challenge by threat score or country, not blanket all traffic. You'll still probably have to IP allow-list the legacy users, which defeats the point you paid for.
Read the contract