The login browser doesn't announce itself as automation - #274
Merged
Merged
Conversation
The operator drives a real login in the session window, but the browser advertised navigator.webdriver=true — the automation flag a logged-in site reads to escalate a session to a verification challenge and then stall it. X did exactly that: the login form rendered, then the flow would not advance. --disable-blink-features=AutomationControlled clears the flag. Verified on the box against this chrome build, driven through session-launch: the flag flips navigator.webdriver from true to false.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The operator drives a real login in the browser-session window, but the browser advertised
navigator.webdriver = true— the automation flag a logged-in site reads to escalate a session to a verification challenge. X did exactly that on the live box: the login form rendered, then the flow silently refused to advance (theknowledge_checkscreen the operator got stuck on).Diagnosed by driving the real browser container on the deployed box: a clean load of X's login flow returned zero 4xx/5xx (the
viewer.json404 seen in DevTools is a normal flow probe, not the blocker), and the one automation tell present wasnavigator.webdriver = true. Tested both configs in the exact chrome build: default → true,--disable-blink-features=AutomationControlled→ false.This adds that flag to
session-launch. Re-verified end to end: patched launcher booted in a container from the published image, driven through its real code path,navigator.webdriver = false.Scope is deliberately the one proven lever. A datacenter egress IP may still draw a challenge; that's the next slice only if this doesn't clear it — re-test after deploy before widening.
Deploy: rebuild and publish
ghcr.io/czpython/druks-browser, then re-pull on the box so the next login window uses it.ENG (P6 browser stealth, evidence-driven first slice)