fix(auth): eliminate spurious TW-Regular reCAPTCHA (step-failure gate + fingerprint parity)#332
Merged
Merged
Conversation
… + fingerprint parity) TW Regular login forced reCAPTCHA(s) that MapleLink never triggers on the same account/IP. Three independent causes: 1. Escalation keyed on the response's IsRecaptcha advisory flag while ignoring ResultCode, so a ResultCode:1 success popped a useless pre-password widget. Now gated on the step actually failing (ResultCode != 1 for CheckAccountType; not 1/2 for AccountLogin), matching MapleLink's guard. 2. The page-fetch GETs (bflogin/default.aspx, Login/Index) went out without sec-ch-ua*/Accept-Language, so beanfun's risk engine flagged the session and demanded reCAPTCHA at AccountLogin. Hoisted those client hints to client-level default headers so every request carries them, matching MapleLink. This eliminated the reCAPTCHA. 3. Switched reqwest from rustls-tls to native-tls (SChannel, as MapleLink/WPF) and pinned http1_only; added a CheckAccountType verdict log for diagnosis. Regression tests added; verified end-to-end against live beanfun.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
TW Regular (帳密) login forced one or more Google reCAPTCHA challenges that
MapleLink never triggers on the same account/IP — the "帳號 → reCAPTCHA → 密碼 →
reCAPTCHA" flow. Root causes:
IsRecaptchaadvisory flag instead ofwhether the step actually failed. beanfun echoes
ResultData.IsRecaptcha:trueeven on a
ResultCode:1success (its own login page only readsResultCode),so a successful
CheckAccountTypestill popped a useless pre-password widget.page-fetch GETs went out without the browser client hints MapleLink sends on
every request, so beanfun flagged the session and demanded reCAPTCHA at
AccountLogin. Confirmed via A/B — same account/IP, MapleLink no popup, wepopped.
Fix
Gate reCAPTCHA on step failure, not the advisory flag.
CheckAccountTypenow proceeds on
ResultCode == 1regardless ofIsRecaptcha;AccountLoginonly escalates when
ResultCodeis neither 1 nor 2. Mirrors MapleLink'sresult_code != 1guard. Removes the useless pre-password widget.Match MapleLink's request fingerprint. Hoisted the constant browser
headers (
sec-ch-ua,sec-ch-ua-mobile,sec-ch-ua-platform,Accept-Language) to client-level default headers so every request —including the page-fetch GETs (
bflogin/default.aspx,Login/Index) —carries them. Previously they were only on the login POSTs, so beanfun flagged
the session on the bare GET and demanded reCAPTCHA at
AccountLogin. Thisremoved the remaining widget. Also switched reqwest
rustls-tls→native-tls(SChannel, as MapleLink and the original WPF client) and pinnedhttp1_only.Diagnostics. Added a
CheckAccountType.Verdicttracing log (parity withAccountLogin.Verdict) exposingresult_code/is_recaptchaper step.Verified end-to-end against live beanfun: no reCAPTCHA, logs straight into the
account list. 766 unit + 19 integration tests pass; clippy clean.