Page 1 of 1

User Login Requests intercepted by Coudflare

Posted: Mon Apr 20, 2020 8:26 pm
by swishly
Hi there

In the last 1-2 days something changed and it appears that user login requests to the API are being intercepted by Cloudflare, which effectively breaks the API

You can test with this curl request (replace [username], [password], [app]...)

curl -L --verbose --data '<?xml version="1.0"?><methodCall><methodName>LogIn</methodName><params><param><value><string>[username]</string></value></param><param><value><string>[password]</string></value></param><param><value><string>en</string></value></param><param><value><string>[app]</string></value></param></params></methodCall>' 'http://api.opensubtitles.org/xml-rpc'

the response is basically this:

HTTP/1.1 503 Service Temporarily Unavailable
Server: cloudflare

Can you look into it?

Re: User Login Requests intercepted by Coudflare

Posted: Tue Apr 21, 2020 7:36 am
by oss
yes, just check other topics why is this happening. We are effectively banning users, who are not using username and password in LogIn() method. The ban takes 1 day and then when still problem persist (we count more than 500 times unathenticated requests), then we ban IP for 2 days and so on. If you need unban some IP, send us request and fix the problem.

Re: User Login Requests intercepted by Coudflare

Posted: Fri Apr 24, 2020 5:36 am
by swishly
Thanks! I think part of the issue is that our program was retrying logins attempts after you banned anonymous logins, so they quickly ran into the limit - and of course they could not access subtitles after login in with a proper account because of the 2-day IP ban.

Are you planning to allow back anonymous logins eventually, or do you consider the change to be permanent?

Re: User Login Requests intercepted by Coudflare

Posted: Fri Apr 24, 2020 5:44 am
by oss
Hi,

good question. We plan this to be permanent, with addition, that some of User Agent developers can subscribe to paid plan, where anonymous users will be possible.

We need to limit anonymous users in order to have better service for everybody and monetize API somehow.

We will send emailing to APP developers today about this issue.