"Too Many Requests"

[CMur12]

Several times recently I have attempted to log in to SMF, only to be blocked by a screen that says, "Too Many Requests."

This after my last "request" (logon0 was at least 24 hours ago.

Any insight into this phenomenon?

Thanks.

- Murray

[drmoss_ca]

As you know, Vince has installed Cloudflare on the forum to cut the number of bots getting in and making accounts. What Cloudflare does is to vet the request and make its best guess as to whether it is from a human. It uses things like how your cursor travels over the page to click on the box to confirm you are human, and if you are too fast or too straight you will get a captcha to solve. Once it decides you are human it issues you a temporary cookie so that you won't see that page again for a couple of hours, and then serves you a cached version of the page at SMF. That part can be done very quickly, which makes up for the annoyance of having to go through the first part.
But if there are too many requests arriving at once you may see the 'Too Many Requests' error (usually Error 429). This is a sign that Cloudflare is doing its job. Remember when we were under a DDOS attack from Singapore—millions of requests arriving at once? That can overwhelm Cloudflare, and you see an error, but at least we don't get thousands of bots joining the forum. Fortunately, that doesn't happen often, and usually the situation resolves quickly.

Chris

[CMur12]

Thanks for the explanation, Chris.

It had given me the impression it was saying that I had made too many requests, but your explanation makes more sense.

- Murray

[CMur12]

This seems to be getting worse, Chris.

I get through the check-box security, only to be blocked by the "Too Many Requests" screen. I would say that at least half of my attempts to get in are blocked, and I only attempt to get in once or twice a day.

The last time I got into the forum was Thursday. I got in early, but left myself logged in to post an SOTD later. A few hours later, when I clicked on the SOTD forum, it took me back out to the "Too Many Requests" screen.

- Murray

[drmoss_ca]

That's strange, as I don't see it and check the forum twice a day. I'll draw ince's attention to this thread and see if he understands what is happening to you.

Chris

[VinceFX]

Ok so here's the current situation. Our beloved site is still under heavy bombardment from bots. The number of attacks from within the US now outnumbers those from foreign countries (China is still #2). I am hesitant to ease our security settings for now.

But what I can do is ease the time to re-prompt legit users for a challenge response after they pass an initial check. This value is currently set at 4 hours. I am going to increase it to 1 week. So in theory, once you're validated as human, you should be let through more easily until that 1 week lapses. Then you will have to potentially be validated again.

Let's give this a try and see what happens. Sorry for the hassle Murray but my hope is that the next time you get through, that authorization should stick for 1 week thereby easing the number of times you have to go through this.

That change is now active. Let me know how it goes.

Best,
Vince

[VinceFX]

Murray...I am also curious to know, which country are you connecting from? I am assuming the USA but if you're traveling and in a different country that could affect your experience. Also, are you using any kind of VPN software that masks your location?

Vince

[drmoss_ca]

I think the majority of those "US" bots are using a VPN as when they do get through they post in cyrillic!

I'll keep track of spammers and report if there is an uptick.

Chris

[CMur12]

Thanks for the replies, Vince and Chris.

The extension for a week, should really help. I like that idea, Vince.

I am in the USA. I'm using a VPN provided by my McAfee security software ... could that be causing the problem? I frequent a forum in Portugal, and I always get a pop-up window offering translation, so it appears that that forum knows I'm from the US, or at least that I'm not in Portugal.

- Murray

[drmoss_ca]

If it is an English version of the browser, it is simply recognising the web page as being in another language. It isn't based on your whereabouts. Let me know if there are any further issues.

Chris

[Gene]

Murray - I am certainly not a VPN expert - but it seems likely that the VPN masks enough of your identity that the SMF electronic guardians see you as a newcomer each time. Can you cycle the VPN off and try again?

Oh - and like you said - sorry we had to rouse Vince from his slumbers.

EDIT_1 - Here's something ... Firefox is now sending this message every time I do a screen refresh (only on SMF, no other pages):

"To display this page, Firefox must send information that will repeat any action (such as a search or order confirmation) that was performed earlier."

I am required to hit a "Resend" button.

EDIT_2 - Now looking at the forum through Chrome. The resend thing NOT seen. So it's Firefox only I guess.

[CMur12]

Chris, I see your point about the language of the browser. I use the Portuguese version of the webpage, but my browser is in English.

Gene, yes, I can turn the VPN on and off. I will try that. I also use Firefox for my browser and I sometimes have to click a "resend" button, though it isn't consistent.

Thanks to you both.

- Murray

[drmoss_ca]

Gene, the 'Resend' thing happens when you refresh a page that required a form (such as a login) to access. It should happen with all browsers, unless when you used Chrome you were not logged in. Once you move on from that page a cookie is set that shows the site you are logged in.
I believe that cookie works just the same even if you are connected through a VPN, and I say that as I do not have to log in again to sites when I switch to a VPN or back again.

Chris

[Gene]

I don't log off when I am finished with a session -- I just move to another tab on my browser (I keep more tabs open than is good for me - can't help it). In Chrome when I click on the SMF tab (usually in the mornings) I hit the refresh button to bring up the most recent stuff. Chrome only asks me to log back in, or ID myself, if I have rebooted my machine, or if I closed the browser and restarted it - the typical action on refresh is a pause and a fresh page reload.