Cloudflare 浏览器完整性检查与 CAPTCHA 挑战

Cloudflare 提供了开发人员经常混淆的两种不同的防御措施：浏览器完整性检查 (BIC) 和 CAPTCHA 挑战。 BIC 是一种被动的标头级检查，可以在没有任何挑战的情况下阻止明显的非浏览器流量 - 它只是返回 403。CAPTCHA 挑战（Turnstile、JavaScript 挑战、托管挑战）提出了合法浏览器可以通过的可解决任务。这种区别很重要，因为每种方法都需要不同的处理策略。

他们如何比较

浏览器完整性检查 (BIC)

BIC 评估 HTTP 请求标头以检测明显的非浏览器流量。它在任何 JavaScript 或验证码挑战之前运行。

BIC 检查什么

BIC流程

Request hits Cloudflare edge
    ↓
BIC evaluates HTTP headers:
  ├─ User-Agent present and valid?
  ├─ Required headers (Accept, Accept-Language) present?
  ├─ Header order consistent with browser?
  └─ IP not on abuse list?
    ↓
Pass → Request forwarded to origin
    OR
Fail → 403 Forbidden (no challenge offered)

通过BIC

BIC 是通过发送适当的类似浏览器的标头来解决的。不需要验证码解决方案：

import requests

# ❌ FAILS BIC — minimal headers
response = requests.get("https://cloudflare-protected.com")
# User-Agent: python-requests/2.31.0
# Result: 403 Forbidden

# ✅ PASSES BIC — browser-like headers
headers = {
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
                  "AppleWebKit/537.36 (KHTML, like Gecko) "
                  "Chrome/120.0.0.0 Safari/537.36",
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,"
              "image/avif,image/webp,*/*;q=0.8",
    "Accept-Language": "en-US,en;q=0.9",
    "Accept-Encoding": "gzip, deflate, br",
    "Connection": "keep-alive",
    "Upgrade-Insecure-Requests": "1",
    "Sec-Fetch-Dest": "document",
    "Sec-Fetch-Mode": "navigate",
    "Sec-Fetch-Site": "none",
    "Sec-Fetch-User": "?1",
}

response = requests.get("https://cloudflare-protected.com", headers=headers)
# Result: 200 OK (passed BIC)

Node.js

const axios = require("axios");

// Browser-like headers to pass BIC
const headers = {
  "User-Agent":
    "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0",
  Accept:
    "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,*/*;q=0.8",
  "Accept-Language": "en-US,en;q=0.9",
  "Accept-Encoding": "gzip, deflate, br",
  Connection: "keep-alive",
  "Upgrade-Insecure-Requests": "1",
  "Sec-Fetch-Dest": "document",
  "Sec-Fetch-Mode": "navigate",
  "Sec-Fetch-Site": "none",
  "Sec-Fetch-User": "?1",
};

async function fetchWithBIC(url) {
  const response = await axios.get(url, { headers });
  console.log(`Status: ${response.status}`);
  return response.data;
}

验证码挑战

BIC 通过后运行验证码挑战。它们需要 JavaScript 执行并提出了可解决的挑战：

Cloudflare CAPTCHA 挑战的类型

挑战流程（与BIC不同）

Request passes BIC check
    ↓
WAF rules evaluate bot score, IP, path
    ↓
Rule triggers CAPTCHA challenge (HTTP 503)
    ↓
Browser executes JavaScript challenge
    ↓
Challenge solved → qa_session_cookie cookie issued
    ↓
Subsequent requests pass with cookie

区分 BIC 块和 CAPTCHA 挑战

当您的请求被阻止时，确定类型即可确定修复方法：

import requests

def diagnose_cloudflare_block(url):
    """Determine if block is BIC or CAPTCHA."""
    # Intentionally use minimal headers to trigger BIC
    minimal_response = requests.get(url, timeout=15, allow_redirects=False)

    # Use browser headers to QA tanılama BIC
    browser_headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
                      "AppleWebKit/537.36 Chrome/120.0.0.0",
        "Accept": "text/html,application/xhtml+xml,*/*;q=0.8",
        "Accept-Language": "en-US,en;q=0.9",
        "Accept-Encoding": "gzip, deflate, br",
    }
    browser_response = requests.get(
        url, headers=browser_headers, timeout=15, allow_redirects=False
    )

    result = {
        "minimal_headers_status": minimal_response.status_code,
        "browser_headers_status": browser_response.status_code,
    }

    if minimal_response.status_code == 403 and browser_response.status_code == 200:
        result["diagnosis"] = "BIC only — fix headers to pass"
        result["fix"] = "Add browser-like headers"

    elif minimal_response.status_code == 403 and browser_response.status_code == 403:
        result["diagnosis"] = "IP or WAF block — not just BIC"
        result["fix"] = "Change IP or check WAF rules"

    elif browser_response.status_code == 503:
        html = browser_response.text
        if "jschl" in html:
            result["diagnosis"] = "IUAM JavaScript challenge"
            result["fix"] = "Use CaptchaAI cloudflare_challenge method"
        elif "cf-turnstile" in html or "challenge-platform" in html:
            result["diagnosis"] = "Managed/Turnstile challenge"
            result["fix"] = "Use CaptchaAI turnstile method"
        else:
            result["diagnosis"] = "Unknown Cloudflare 验证流程"
            result["fix"] = "Inspect page source for challenge type"

    elif browser_response.status_code == 200:
        html = browser_response.text
        if "cf-turnstile" in html:
            result["diagnosis"] = "Page loads but has Turnstile widget"
            result["fix"] = "Use CaptchaAI turnstile method for form submission"
        else:
            result["diagnosis"] = "No challenge — page accessible"
            result["fix"] = "None needed"

    return result


# Usage
diagnosis = diagnose_cloudflare_block("https://example-cf-site.com")
print(f"Diagnosis: {diagnosis['diagnosis']}")
print(f"Fix: {diagnosis['fix']}")

常见场景

场景 1：仅 BIC 区块

Request with python-requests UA → 403
Request with Chrome UA → 200 ✓

Fix: Add proper browser headers. No CaptchaAI needed.

场景2：BIC通行证，然后CAPTCHA

Request with Chrome UA → 503 (challenge page)

Fix: Headers are fine. 使用 CaptchaAI solve the challenge.

场景3：BIC + CAPTCHA 一起使用

Request with python-requests UA → 403 (BIC block)
Request with Chrome UA → 503 (CAPTCHA challenge)

Fix: First fix headers, then solve CAPTCHA with CaptchaAI.

场景 4：两者都不是 — IP 封锁

Request with python-requests UA → 403
Request with Chrome UA → 403

Fix: Neither BIC nor solvable challenge. IP is blocked.
Try different IP/proxy.

标头最佳实践

传递 BIC 的基本标头

CLOUDFLARE_SAFE_HEADERS = {
    # Mandatory
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
                  "AppleWebKit/537.36 (KHTML, like Gecko) "
                  "Chrome/120.0.0.0 Safari/537.36",
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
    "Accept-Language": "en-US,en;q=0.9",
    "Accept-Encoding": "gzip, deflate, br",

    # Strongly recommended
    "Connection": "keep-alive",
    "Upgrade-Insecure-Requests": "1",

    # Sec-Fetch headers (modern Chrome)
    "Sec-Fetch-Dest": "document",
    "Sec-Fetch-Mode": "navigate",
    "Sec-Fetch-Site": "none",
    "Sec-Fetch-User": "?1",

    # Recommended for consistency
    "Sec-Ch-Ua": '"Not_A Brand";v="8", "Chromium";v="120", "Google Chrome";v="120"',
    "Sec-Ch-Ua-Mobile": "?0",
    "Sec-Ch-Ua-Platform": '"Windows"',
}

触发 BIC 阻止的标头

故障排除

常见问题

我可以为我的网站禁用 BIC 吗？

是的。站点操作员可以在 Cloudflare 仪表板中的“安全”>“设置”下禁用 BIC。所有计划均默认启用此功能。

BIC 是否检查 TLS 特征？

不直接。 BIC 专注于 HTTP 标头。但是，Cloudflare 更广泛的机器人管理（企业）确实会与 BIC 分开检查 JA3/JA4 TLS 特征。

如果我通过了 BIC，我还会获得验证码吗？

是的。 BIC 和 CAPTCHA 挑战是独立的层。通过 BIC 意味着您的标头看起来合法。您仍然可以从 WAF 规则、机器人评分或 IUAM 模式触发验证码。

CaptchaAI对BIC有帮助吗？

不 - BIC 并不提出可解决的挑战。修复您的 HTTP 标头以传递 BIC。 CaptchaAI 处理 BIC 通过后出现的验证码挑战（Turnstile、JavaScript 挑战、托管挑战）。

Sec-Fetch 标头如何影响 BIC？

现代 Chrome 自动发送 Sec-Fetch-* 标头。它们的缺失并不总是会触发 BIC，但包含它们会使您的请求配置文件与真实浏览器更加一致。

概括

Cloudflare 的浏览器完整性检查会阻止具有明显非浏览器标头的请求 (403)，而 CAPTCHA 挑战则提出可解决的任务 (503)。 BIC 通过使用正确的类似浏览器的标头来修复 - 否CaptchaAI需要。验证码挑战需要 CaptchaAI 的 Turnstile 或 Cloudflare 验证流程 解算器。始终首先诊断块类型：修复 BIC 标头，使用 CaptchaAI 进行验证码，并更改硬块的 IP。

相关文章

• Cloudflare 验证流程 与旋转门检测对比
• Geetest 与 Cloudflare Turnstile 比较
• Cloudflare 托管与交互式挑战