t0astbread / onionflare

Prevents Cloudflare CAPTCHAs on Tor via Firefox

Who is this for?

People browsing the web over Tor but not with the Tor Browser

What does this do?

Less technical explanation

Cloudflare lets Tor Browser users in CAPTCHA-free while requiring a CAPTCHA for all other Tor connections. This extension emulates some of the Tor Browser's behavior (you won't notice this) to trick Cloudflare into thinking you use the Tor Browser.

Note: It seems that newer versions of Firefox don't need this add-on anymore to pass CAPTCHA-free on websites behind Cloudflare. It is recommended to uninstall this extension and, unless edge cases are found, the extension will be removed from the store. If you still have a use-case for it, open an issue or download it from the GitHub repository.

Technical explanation

Cloudflare uses the "alt-svc" HTTP header to transparently redirect Tor users to its own hidden service (which it calls "Cloudflare Onion Services"). If accessed over this service, users are not required to complete a CAPTCHA to see a Cloudflare-protected website.

Unfortunately, Cloudflare only sends the alt-svc header if it thinks the request comes from the Tor Browser, even though other browsers are also capable of using Tor via a proxy. This extension adjusts Firefox's request behavior (in particular the headers) to look more like the Tor Browser, so that Cloudflare sends the alt-svc header and no one has to bother with CAPTCHAs anymore.

Note that this extension can't prevent all CAPTCHAs. Website administrators can choose to disable the Cloudflare mechanism that enables this. You would also see a CAPTCHA over the Tor Browser in that case.

Links

• AMO: https://addons.mozilla.org/en-US/firefox/addon/onionflare
• GitHub: https://github.com/T0astBread/onionflare

Attribution

The icon is made of several photos created by other people:

• "Bulb" by Shutterbug75
• "Flare" by Jonathan Duran
• "Onion" by jmexclusives

onionflare's Issues

User-Agent possible conflict

When I used the addon User-Agent Switcher (by Linder), Cloudflare would never let me pass, regardless of onionflare.

After switching to User-Agent Switcher and Manager (by Ray) I had simply no issues at all.

So here are the block of text you requested (old addon and onionflare):

Host: www.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux i586; rv:31.0) Gecko/20100101 Firefox/31.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

And this is how it looks with the new addon and onionflare

Host: www.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:75.0) Gecko/20100101 Firefox/75.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
TE: Trailers