onStart hook unable to solve CloudFlare challenge

[jasonjei]

When testing the hook with the docker compose setup with the 2Captcha Turnstile test, I get challenged by CloudFlare. It seems to detect the captcha, but is unable to convince CloudFlare Turnstile that it's human-like in clicking the checkbox. Actually, I'm not sure if it sees the shadow DOM element.

docker-compose.yml:

      # Hook that runs on proxy start
      ON_START_HOOK_FILE_PATH: /work/hooks/onstart.js
      # Hook that runs before each HTTP request

Output from docker compose starting:

thermoptic-thermoptic-1  | 2025-10-16T16:52:10.836Z [INFO] Waiting for CDP availability. {"host":"chrome","port":3003,"poll_interval_ms":1000,"startup_timeout_ms":null}
thermoptic-thermoptic-1  | 2025-10-16T16:52:10.856Z [INFO] CDP is available. {"host":"chrome","port":3003}
thermoptic-thermoptic-1  | 2025-10-16T16:52:11.383Z [INFO] thermoptic has begun the initializing process.
thermoptic-thermoptic-1  | 2025-10-16T16:52:11.385Z [INFO] A thermoptic onstart hook has been declared, running hook before starting proxy server... {"hook_file":"/work/hooks/onstart.js"}
thermoptic-thermoptic-1  | 2025-10-16T16:52:11.736Z [INFO] Waiting until Cloudflare JavaScript challenge is complete.
thermoptic-thermoptic-1  | 2025-10-16T16:52:11.744Z [INFO] Passed Cloudflare JavaScript check, continuing startup.
thermoptic-thermoptic-1  | 2025-10-16T16:52:12.550Z [INFO] The thermoptic HTTP Proxy server is now running.
thermoptic-thermoptic-1  | 2025-10-16T16:52:12.551Z [INFO] Health probe endpoint listening. {"port":8085,"path":"/__thermoptic_health"}
thermoptic-thermoptic-1  | 2025-10-16T16:52:12.728Z [INFO] Health probe succeeded. {"duration_ms":175}

Output from curl:

$   curl --proxy http://changeme:changeme@127.0.0.1:1234        --insecure        -v        -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36'    https://2captcha.com/demo/cloudflare-turnstile-challenge
*   Trying 127.0.0.1...
* TCP_NODELAY set
* connect to 127.0.0.1 port 1234 failed: Connection refused
* Failed to connect to 127.0.0.1 port 1234: Connection refused
* Closing connection 0
curl: (7) Failed to connect to 127.0.0.1 port 1234: Connection refused
[ec2-user@ip-172-31-21-93 ~]$   curl --proxy http://changeme:changeme@127.0.0.1:1234        --insecure        -v        -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36'    https://2captcha.com/demo/cloudflare-turnstile-challenge
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to 127.0.0.1 (127.0.0.1) port 1234 (#0)
* allocate connect buffer!
* Establish HTTP proxy tunnel to 2captcha.com:443
* Proxy auth using Basic with user 'changeme'
> CONNECT 2captcha.com:443 HTTP/1.1
> Host: 2captcha.com:443
> Proxy-Authorization: Basic Y2hhbmdlbWU6Y2hhbmdlbWU=
> User-Agent: curl/7.61.1
> Proxy-Connection: Keep-Alive
>
< HTTP/1.1 200 OK
<
* Proxy replied 200 to CONNECT request
* CONNECT phase completed!
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* CONNECT phase completed!
* CONNECT phase completed!
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: C=US; O=Thermoptic Proxy; ST=CA; OU=Thermoptic Browser Proxy; CN=2captcha.com
*  start date: Oct 14 16:59:02 2025 GMT
*  expire date: Jan 17 16:59:02 2028 GMT
*  issuer: C=US; O=Thermoptic Proxy; ST=CA; OU=Thermoptic Browser Proxy; CN=Thermoptic Proxy
*  SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
> GET /demo/cloudflare-turnstile-challenge HTTP/1.1
> Host: 2captcha.com
> Accept: */*
> user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
>
< HTTP/1.1 403 Forbidden
< date: Thu, 16 Oct 2025 16:53:18 GMT
< content-type: text/html; charset=UTF-8
< report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ox4rLHy57i9YOeVaZ23WRoqQ3Lp%2BfxZtXGmj7Nzg21w03hI92zZzhfbTrt%2BDMniuwvDAtjbkb9VbmaNodlDjOqJmy8dYO%2By4r0tihv4dzoavOK7whRz9PX4ImjQbEg%3D%3D"}],"group":"cf-nel","max_age":604800}
< priority: u=0,i
< content-encoding: br
< accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
< cf-mitigated: challenge
< critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
< cross-origin-embedder-policy: require-corp
< cross-origin-opener-policy: same-origin
< cross-origin-resource-policy: same-origin
< origin-agent-cluster: ?1
< permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
< referrer-policy: same-origin
< server-timing: cfL4;desc="?proto=QUIC&rtt=1496&min_rtt=1215&rtt_var=401&sent=10&recv=10&lost=0&retrans=0&sent_bytes=4103&recv_bytes=4607&delivery_rate=7847125&ipace=0&icwnd=12000&ss_exit_cwnd=0&ss_exit_bw=0&ss_exit_reason=0&cwnd=16075&unsent_bytes=0&cid=2fa29438da47d8bb&ts=25&inflight_dur=5&x=118"
< x-content-type-options: nosniff
< x-frame-options: SAMEORIGIN
< cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
< expires: Thu, 01 Jan 1970 00:00:01 GMT
< cf-ray: 98f91258ad66d6d5-IAD
< server: cloudflare
< vary: Accept-Encoding
< nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
< alt-svc: h3=":443"; ma=86400
< Content-Length: 9715
< Connection: keep-alive
< Keep-Alive: timeout=5
<
<!DOCTYPE html><html lang="en-US"><head><title>Just a moment...</title><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><meta name="robots" content="noindex,nofollow"><meta name="viewport" content="width=device-width,initial-scale=1"><style>*{box-sizing:border-box;margin:0;padding:0}html{line-height:1.15;-webkit-text-size-adjust:100%;color:#313131;font-family:system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Helvetica Neue",Arial,"Noto Sans",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"}body{display:flex;flex-direction:column;height:100vh;min-height:100vh}.main-content{margin:8rem auto;padding-left:1.5rem;max-width:60rem}@media (width <= 720px){.main-content{margin-top:4rem}}.h2{line-height:2.25rem;font-size:1.5rem;font-weight:500}@media (width <= 720px){.h2{line-height:1.5rem;font-size:1.25rem}}#challenge-error-text{background-image:url("data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIzMiIgaGVpZ2h0PSIzMiIgZmlsbD0ibm9uZSI+PHBhdGggZmlsbD0iI0IyMEYwMyIgZD0iTTE2IDNhMTMgMTMgMCAxIDAgMTMgMTNBMTMuMDE1IDEzLjAxNSAwIDAgMCAxNiAzbTAgMjRhMTEgMTEgMCAxIDEgMTEtMTEgMTEuMDEgMTEuMDEgMCAwIDEtMTEgMTEiLz48cGF0aCBmaWxsPSIjQjIwRjAzIiBkPSJNMTcuMDM4IDE4LjYxNUgxNC44N0wxNC41NjMgOS41aDIuNzgzem0tMS4wODQgMS40MjdxLjY2IDAgMS4wNTcuMzg4LjQwNy4zODkuNDA3Ljk5NCAwIC41OTYtLjQwNy45ODQtLjM5Ny4zOS0xLjA1Ny4zODktLjY1IDAtMS4wNTYtLjM4OS0uMzk4LS4zODktLjM5OC0uOTg0IDAtLjU5Ny4zOTgtLjk4NS40MDYtLjM5NyAxLjA1Ni0uMzk3Ii8+PC9zdmc+");background-repeat:no-repeat;background-size:contain;padding-left:34px}@media (prefers-color-scheme: dark){body{background-color:#222;color:#d9d9d9}}</style><meta http-equiv="refresh" content="360"></head><body><div class="main-wrapper" role="main"><div class="main-content"><noscript><div class="h2"><span id="challenge-error-text">Enable JavaScript and cookies to continue</span></div></noscript></div></div><script>(function(){window._cf_chl_opt = {cvId: '3',cZone: '2captcha.com',cType: 'managed',cRay: '98f91258ad66d6d5',cH: '5U6NxkLXx6ZfJuwrFbJCbaIOzbJQNYgBbCfafCEgdQQ-1760633598-1.2.1.1-od_v_XTVrgp3xDy4nnD8izLMqK_sCDiggjGg2APu_mElbaGVWXIjLbygMemPvw8u',cUPMDTk:"\/demo\/cloudflare-turnstile-challenge?__cf_chl_tk=QWRTPU.L9fv_mbTUvxgvUhvJydUTa9jMYGPVgSw5Psg-1760633598-1.0.1.1-.qekbKtUajaffB_pc8jgIE_1.schhxiKbD5fmZcup2s",cFPWv: 'g',cITimeS: '1760633598',cTplC:0,cTplV:5,cTplB: 'cf',fa:"\/demo\/cloudflare-turnstile-challenge?__cf_chl_f_tk=QWRTPU.L9fv_mbTUvxgvUhvJydUTa9jMYGPVgSw5Psg-1760633598-1.0.1.1-.qekbKtUajaffB_pc8jgIE_1.schhxiKbD5fmZcup2s",md: 'XNoJ0dco6jWf4vyEPopbntm1DyKBBaRnNmsbueNZB2s-1760633598-1.2.1.1-uYgJn7drFHsidGFuSkEiNqoqx6Sf78409cbghGQb7Mm6NtEFbyRrcH4tX6aTqQ4jvacZtIxbPzwTphNQAJjiNye2qJEJXiEYCvL2h5v1OGDaHtYMD1qtMEaFXqbeGIwUd78kJfyu0dukJUgqX7w1WKpvmFDWIupZKuYSRa399uwM6egpcU9qwjKyfjMhaWqnxLDyd4N0gKdNr1wfjTAyf50xZn_jiDzey9VfvKk6EkXBMWAk4exZZfCd_er3ruqStKqcOyt9hSd2.MKnb.0OUaa5pcB6GCeu8Yntxiol1Ui9LWOltkXUWb0vFHN8t8jE9166kgiJTRgr7NJZlpuHU4N0lMeF0P4B4PVRgRI3fAHW2fcwDNNTaPIGRgN0PTMJZnvW0o0cCb_FVGjTXfxcz1hmbcFNOUFuU2Q7uDyIl27K5U4lJ3ZNKFDSzEU8ks5aHsQ9GZli18xdHAyUC9.Dw_2BBXvNzhMFcBa4V1W6_bD0z4Oc3BZvu7M.ElioDTq8h5GaMS_7QbM5F2xbgpS05ER1_J8QVMr5QnYW5hEfQr0Hc9q6c3nUDNU4Umth.5_kuATBYSnI_GxwF_U7qsJfjQyns3HQTTP2ff3hxTNYoorj98klWoE7Ked5usen_q2rJnI_1hwRwu_9VRurHhSm.dkZBZysufqaTNwz1Easj3a.W4rKHbCMuvxNUXZ9is3sjX_9Mcz1LKXxiAX2fGKQX2_pPMAsYY6PKEgIhIW4S9OKXncMHKgnDyipwKCHcTUsGO.MsNItNql85ShunXSPHXOl4MIA_NBaZyoNMcs_f4R0dMuaEvYqVlR7okN76GFiPHWrUSyJQNFx7i.Osa5.nLsb.m48cgNB9ShvQIY4Jxav3c9obz5bFfKIZMdUlS2PlDap3hbA9YsdSrb.CMPVuR31..yEmrDIIPx8TC8orFGUJZ68XVlsbNO8JdLtmsX_iA_wNiijKa3fx71c6rMO23OuQOzU3_CYDfafS3HQGlFIeAhyD80cyI4GD2xs0RiVlvn8BA2aPjKmChnDxrLrxFj1sBU2hHpyNgpdzE0FVwbBE5CXjesI1YrjAeglj9y5',mdrd: 'f5iHBcfUk28ZOwwp3tL.6PIuZs5xFTcw_GUQFbgS77Y-1760633598-1.2.1.1-_53Vj2TNbKz1bwDR50w9NGE2N041El5pXL4FEvLhH1_J5m6MXk5jz07YcoIWV.IewS9srMRe1rbR1aDzLihmJssKqy79sg07ro8lr4w5mUz7a_aBgdmJammLt1JbXGuIW_irSdOEKQJZuSOgKz2H7iwZtIWsuawKCHLDxcmB9sosfaZkEEedJ8997K0iy1u4tRMFNSsrgXik92mbE4I0KDrlquUT0DlHFH4CzqwN5NbFOGtvhpt9lhA.e2xwWqC9UTZST5kCWgh5XKXAUzcnRqk_L9D7EYzNE.yEidhnWlZMZ1X5BBCVNASK6vOzWJbOXzLicvK3TCNB9VEOyp4cNkEMxzDDunSA8dPDHBb4W97qbi5WctfSXZSZl_sST7boAFvA2hIhKhgGVA1A37jIAyVoq88EBthIZux1JB4N3Mwr478.WhsAU9yOXGqk4M1JI.aMA7hs74Jb_uwj9GTyiVzI88nGQNyWLMzD0Q9hFGrLBYfMjb1jJ3q9XMB5d7xHPIhfFuNAbg16STid1XTEqzAAuniuiCiLLCGag7J1Qd4mnx5GzgRY75Nwh0HUc8tSdmQcfZTPE_qvRSFuwKSor2BIwvXrB1zUpY3xSshvq3nIVpqWSdbPGtQ4Ui5WM8ZTKWwke6Taor__kgdmdSbfreuVvsSXAf2oFghHYUbX0Avecl.M9LbuzDaPWPT9sJoJqbkdkZtYWiVBnwqUtKCsbtOZvBaTmtV48_VRFFX5xjauoyY0xhuXTitHoPJtJGsjSXLd6EZlK9PmxlAiiX3ERzkHoPDE1vt8vsz6Q1eO9mjvUqcL4tCUzLav1nYqmBm6PBojsiW_OQ0zBnqILXOIPOd1Y0lnOIh4AB2YMQcAmceyMkVbdr.WBoxPTAOCxTnGs5IL0mT15S6uneUmufynvT.TDUapgMzAIfMBMkHY3ekfF20RIQV4y2INBQVaCI4gRxX3GwtVjUJ4HExFkMMpJBZImBb_3eyvqa4ztG7i4hZoTNYspDu.FQQZqem.1Yq2mkxSOU.V71fc7g6ItgQDTAs2.m.b.c5ySDvS6oAT85NsKrCI4DdgOKKAGnas6WdBcVK.0CfnQGuh1UTCOB8lINoMdwYhNCEkegM94lRFHm.Q957p4k_VU.qBDP.kTsOpxtm02gMKlMvsHYWZuZQ4MWDwlhiiko83bRQDr1wZNNChjzOrdM_0oaV.TVxKsakv0_TgIHOUWi0huaoAgIIlb2PbE3JJ3.5kxmjmsMUzgKhKsyF.ipeUuUpmgoZDtx3bK.ClRDVag4g0D6KsgHecW7_kuaFcEA9jDEen3.hOpBJ1JbbJuoEJwweUZSWktvWXQqSeztbv9j8p0wE55vOmqICzSc9MdGECSmdvDO2ANkbOZCQCvyXwdq8OeYos4q7ijuSCSuWCXfEEJxoc7K.JnVnsgtb.aLHzHtX7MoR6HSMipD_NMVsWWv.tyr5sHlC.ozs1EUxQlZ9SIcF6JDZeoCPux6UkEbPbBUkHMzgxphRuaty8K.r7nQJIPjQTIElWULYw4g8t0cKBnNaoWyeSqyQdvFGTSLGOYWI4gI7BAnXZdOnMUy_wvsdJ7bT9g1Vg70B7HN2v4uhH9fgJhfMtqTT6Lsm4CxVamqeCzRCzL3admzqU1Q.pcFfAECXKsC_Dj1J2pDvimtgb.TiaY9gbr9rrAWekJGOoBe5C8XJVBBNRM6oT8pJdx0iwUqVhIZzJ.4JpqAgBOnnlCkTYfZBX.bwBMhoobDR7gxt.EIkLxaph6g_riZKot50QLc7MwXKKk7GfrSsAJwdKBob3GzDSsUT29ax59VxZCdYkOeukjZ40r_sZQwe1qhg4dEDWskoJGbVqOr_Y9Y3xtiNYDQ7Bmdcm3TMeTZaIko2.9y9zD8yShTfd22kahgZTulcCnbXeBzMedZ9GRswwMGhhXsGTDe2Ug16xzawNhfgxVxO1Oqu6IYAEb7ByLBUS3qR8RlIfGMwljE.FOeSfSMg2tAHY4xbaS5K1oi_zDJc9B.Fy58BGi4phZ8uh2Kvr_x9R7gvjXw7SNyDx9Rvol5Ywm6UoMHLnHtYdx.C_94.fQK0dcxT3PUwxtXX2qo_xv_cQbMDFXiYfE9Q8_tAn9jPHXvIdOSM3iTrJATfUMkvypZULuuzumtKrHhrVSIq_28OKyprLtqELXWW6Kb.RLfEICq8SP9rlz7TegusiCo.g5OVlIi2uXB8XSnBVTpflcMw6xvx1V2r4dss2rIZUsq.bLSRDLHJn3oS39yQgenDa.OvBGPIXd1zG9f0oYZjjArRWZWLzBdYA1GL7w1KzsPh1lLLepvfD2ftg.Trdaf6OnYRJ9qp5FSMpsyaJ4Z7A02Hyx.Zdrdz69LxJcxuLZkItfkP0IDnIqSig1u6gs59AGtJAkd2gDifGIrsE8F8QS9sS6XfCIG2kDlZx7xaY2bJR6Hwiibd6ba._BH0ZCjX42oJ3RArsOxTXa60o5kWSHPJmGr3NyBDgnjPJYH.ANFld6gCVUXJFBB2iHFOVn3Kl8fU90AfWnTBum8XA74aT2VxzPJNzePLIVifjSwK2_pngjEETQbAotonxdH6W_n3dH9WuPPJeQwryeqxHHCQtgdxxf9GhZB269SUt84zP3PzfHoytxrA_H75HV1G7tz8m5ypu4M06o7QfrZE7iY8WXyU9VgsKApm1Ge9OzX82uk4T2z.Tpe9oRQi_vSOLzZWQziRUjxVXY0FpJufy1zeSXJO2xx2oEB3LZ5B0zS0NPuj9fFFZu_zRJz3Nc6rbjRYv8jlV9dvSNrfE5sypsgNQ1zkqnwYlJiRQ0KFOI6KO_N.NvX.00Zdq0BXhttjeObseBrEubJrK_lTrADQPwKEBQctJJfnrF7OQVvbw9z54.zlbuq0rPdmQBSIwHKh2Se4OZXm_xIqavQgccn3.YRqQS34CW.CMsiE9WsIXqQTOjY5mij67pks6CwCumqXnaDsEoSJTBPVEp2Bjz04Qp0B8vqgFWgt2M0AXX4oByCnD1mIQEw5RR9NPip0RAC17D6GZw6W7OAtQxrArzQH_tVsaI6RjRzZD1s6Rjg5eyMt1oZli3x3jMtmmNkNYZJw_slMNPfkqGonUXmiV8GWvNH2SvD3nxwULszRZCnQerkWPVj8bWc1CyTF2pcEfP1okzo2cWsiB7B8tqM.XkKYKFhLDSNocpCynn2iHZwCFu0N_VHYo4TVFkfSGFYCHrmnf2RHPE.GEZJ8.kq1ZhTu08yiY54fkL43QbNY0QXrNhvyXiE1U2S10d9tgj5lZoun4SkIo0co5IC21xQ_kfxiGUfJ46.RVJhaFF.PhrKN3YHFfblo2HSvbqCaE1e2AklXGShVx4PXHjE4UVA2PjRr2HAYdNbPrxxvV33b1MDJM9HHIK4XrgJGoFwWrPyajS_o8oxMLTklKV7zfEoSq5xeU1Fywqfjhxqo0NZj4hhj1gGRqgH2D1GinuRm2Kdvqz0jLNkKC1J8_67duxNNalqzrXb6YPzbl9Na_rPy8TOYvs4vCVokkAXlQvnnNkDqlAUefYzPJ_OUJYunzObYtN8S36C2ObDS2iIDr4ujKyhDyD2nKROQfbvh2l8wnTZotE9aK41hdO6YXvNcgLhH1oVg8_lW4wnWsbP6KDZT.p5sfk_21qNf.JxL0ObmhKt1R0UgPxL5VMcaO.J0v.QWLxVN_ov5qOgq2EoGTvPYmoOmqlfCYEndRm0ReV0rvzfnR.gGyRH72cnIUjbPKc4bZOBoC1ACERryMleYV_2uMMpExJLlsaVyxNorEbHuKAEGVYO5rklP77lNQVL_FPXbrX_HnoFtj7p1gRE2b6aL.vBTOEhLrMCE1lzcvdcA5a111b3h9Ast2IgP79f_Q0mNdgOCjd4L33qEQ9xMwZFrLEI2_vUWadftA9vIxtlkuG0kGQhjf0DxU9eFJXRezPCevN9OhoCzGuxxIAGVbnQkX491oBVy4gnQZZ0asvzzzL0sA8DedvtHKa.pQNMg1MNQ5klXrrLK16AAZ6dBu_NMySqOSpwlZjMFlkhDnBGLABck8kZtnVa_0eIVoOohnKE3t7qYYcQBDAOFvEl6oUCqgxxNK_sRzbT6oVMIUj8hgqgkw3NeNj.6EnttENg4DLMCUdwXrC9cPG59XVLlpsPA.iHDCJHdd4w8Bm5bJ2Aom.pBDbYEHqO9l3s9UsQwJKUkMUYmr4dIQbPplIwpkevX33OyykxUNrPi7aOP.hRpJCKj6LBvypDoyU32tEumMarHU297Zw2bOvAc9cYr3M38i..yR2JTscCnjJWG02pwGivd6nBreqiFU_KsW.EgOwYvFQcSyLPkUaK5uSl9UukJUHYI2Ks6n7b63gqAvh48JQByTzSdv2BI1vqCF84S0mHm4..4PGpv82xG37s0YNsJUjHlEWNsgTuWj9L4fwg',};var a = document.createElement('script');a.src = '/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=98f91258ad66d6d5';window._cf_chl_opt.cOgUHash = location.hash === '' && location.href.indexOf('#') !== -1 ? '#' : location.hash;window._cf_chl_opt.cOgUQuery = location.search === '' && location.href.slice(0, location.href.length - window._cf_chl_opt.cOgUHash.length).indexOf('?') !== -1 ? '?' : location.search;if (window.history && window.history.replaceState) {var ogU = location.pathname + window._cf_chl_opt.cOgUQuery + window._cf_chl_opt.cOgUHash;history.replaceState(null, null,"\/demo\/cloudflare-turnstile-challenge?__cf_chl_rt_tk=QWRTPU.L9fv_mbTUvxgvUhvJydUTa9jMYGPVgSw5Psg-1760633598-1.0.1.1-.qekbKtUajaffB_pc8jgIE_1.schhxiKbD5fmZcup2s"+ window._cf_chl_opt.cOgUHash);a.onload = function() {history.replaceState(null, null, ogU);}}document.getElementsByTagName('head')[0].appendChild(a);}());</script><script defer src="https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015" integrity="sha512-ZpsOmlRQV6y907TI0dKBHq9Md29nnaEIPlkf84rnaERnq6zvWvPUqr2ft8M1aS28oN72PdrCzSjY4U6VaAw1EQ==" data-cf-beacon='{"rayId":"98f91258ad66d6d5","serverTiming":{"name":{"cfExtPri":true,"cfEdge":true,"cfOrigin":true,"cfL4":true,"cfSpeedBrain":true,"cfCacheStatus":true}},"version":"2025.9.1","token":"c2ce8cb0fb464bb1a66f48dc9bf19c21"}' crossorigin="anonymous"></script>

[mandatoryprogrammer]

Having trouble reproducing this on my end, when I do a hook for this it works:

$ curl --proxy http://changeme:changeme@127.0.0.1:1234 --insecure -v -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537' https://2captcha.com/demo/cloudflare-turnstile-challenge
*   Trying 127.0.0.1:1234...
* Connected to 127.0.0.1 (127.0.0.1) port 1234 (#0)
* allocate connect buffer
* Establish HTTP proxy tunnel to 2captcha.com:443
* Proxy auth using Basic with user 'changeme'
> CONNECT 2captcha.com:443 HTTP/1.1
> Host: 2captcha.com:443
> Proxy-Authorization: Basic Y2hhbmdlbWU6Y2hhbmdlbWU=
> User-Agent: curl/7.88.1
> Proxy-Connection: Keep-Alive
> 
< HTTP/1.1 200 OK
< 
* CONNECT phase completed
* CONNECT tunnel established, response 200
* ALPN: offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN: server accepted http/1.1
* Server certificate:
*  subject: C=US; O=Thermoptic Proxy; ST=CA; OU=Thermoptic Browser Proxy; CN=2captcha.com
*  start date: Oct 17 19:22:10 2025 GMT
*  expire date: Jan 20 19:22:10 2028 GMT
*  issuer: C=US; O=CursedChrome Proxy; ST=CA; OU=CursedChrome Browser Proxy; CN=CursedChrome Proxy
*  SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
* using HTTP/1.1
> GET /demo/cloudflare-turnstile-challenge HTTP/1.1
> Host: 2captcha.com
> Accept: */*
> user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537
> 
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
< HTTP/1.1 200 OK
< date: Sat, 18 Oct 2025 19:22:10 GMT
< content-type: text/html; charset=utf-8
< server-timing: cfL4;desc="?proto=QUIC&rtt=19007&min_rtt=13771&rtt_var=8273&sent=12&recv=10&lost=0&retrans=0&sent_bytes=4202&recv_bytes=3916&delivery_rate=133866&ipace=6460080&icwnd=92400&ss_exit_cwnd=0&ss_exit_bw=0&ss_exit_reason=0&cwnd=12000&unsent_bytes=0&cid=ff205ff15da299a3&ts=291&inflight_dur=111&x=118"
< priority: u=0,i
< content-encoding: br
< vary: Origin, Accept-Encoding
< access-control-allow-credentials: true
< content-language: en
< strict-transport-security: max-age=31536000
< content-security-policy: frame-ancestors 'self' 2captcha.cn cn.2captcha.com web.telegram.org;
< cf-cache-status: DYNAMIC
< cf-ray: 990a6727df1ba230-SJC
< server: cloudflare
< nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
< report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p62mIPrYOtpY4NAF1rpaytrVAFJ63dhCwW23nH1t1tsPHlPNbj005aJcUY7grwqc2Cy1pfdp2UQ%2B6E7CSgQ7R7BFAj6OineUTZMP3%2BNPe7PxqwBrsNIBq7tpbgMtVw%3D%3D"}],"group":"cf-nel","max_age":604800}
< alt-svc: h3=":443"; ma=86400
< Content-Length: 254262
< Connection: keep-alive
< Keep-Alive: timeout=5
< 
<!DOCTYPE html>
<html lang="en" >
  <head>
    <meta charset="UTF-8" />
    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
    <meta name="viewport" content="width=device-width, initial-scale=1" />
    <meta name="yandex-verification" content="301de5880a523d63" /><meta name="baidu-site-verification" content="codeva-pQYHEf9HaN" /><title data-rh="true">Cloudflare Challenge demo: Sample page with Cloudflare Challenge Turnstile</title><meta data-rh="true" name="description" content="Cloudflare Challenge demo. Try out the various forms of Cloudflare Challenge"/>
...trimmed for brevity...

Can you post your full onstart.js?

Actually, I'm not sure if it sees the shadow DOM element.

The shadow DOM isn't relevant, it does a regular click action like a human so these tricks don't matter as they're mainly meant to complicate DOM parsing/JavaScript trickery.

[mandatoryprogrammer]

Your log output for thermoptic is also odd as it doesn't imply it's getting the CAPTCHA at all, your output should be like this:

thermoptic-1  | 2025-10-18T19:24:17.318Z [INFO] thermoptic has begun the initializing process.
thermoptic-1  | 2025-10-18T19:24:17.319Z [INFO] A thermoptic onstart hook has been declared, running hook before starting proxy server... {"hook_file":"/work/hooks/onstart.js"}
thermoptic-1  | 2025-10-18T19:24:18.276Z [INFO] Waiting until Cloudflare JavaScript challenge is complete.
thermoptic-1  | 2025-10-18T19:24:21.085Z [INFO] A Cloudflare turnstile CAPTCHA has appeared, attempting to click through it.
thermoptic-1  | 2025-10-18T19:24:27.974Z [INFO] Passed Cloudflare JavaScript check, continuing startup.
thermoptic-1  | 2025-10-18T19:24:28.407Z [INFO] The thermoptic HTTP Proxy server is now running.

e.g. Your message output doesn't contain A Cloudflare turnstile CAPTCHA has appeared, attempting to click through it. - which indicates the hook isn't seeing the CAPTCHA prompt at all (or isn't recognizing it).

[jasonjei]

I'm using the stock onStart.js from de7e994 with only this change:

diff --git a/hooks/onstart.js b/hooks/onstart.js
index 003704c..4087dfd 100644
--- a/hooks/onstart.js
+++ b/hooks/onstart.js
@@ -61,7 +61,7 @@ export async function hook(cdp) {

     // Replace with the site that has the Cloudflare JavaScript check
     // that runs the first time you visit it.
-    await Page.navigate({ url: 'https://example.com/' });
+    await Page.navigate({ url: 'https://2captcha.com/demo/cloudflare-turnstile-challenge' });
     await Page.loadEventFired();

     hook_logger.info('Waiting until Cloudflare JavaScript challenge is complete.');

Some Host OS details:
OS: Linux 6.1.0-39-cloud-amd64 (Stock GCP VM)
Architecture: x86_64
Node: v22.20.0
Docker version 28.4.0, build d8eb465
Docker Compose version v2.39.4

Ran it again just now, and it's still just skipping the clicking part and returning the CF challenge, as expected, because no clicking happened. Otherwise no changes to the compose or anything else from the checked out repo.

2025-10-18T22:05:23.875Z [INFO] A thermoptic onstart hook has been declared, running hook before starting proxy server... {"hook_file":"/work/hooks/onstart.js"}
2025-10-18T22:05:24.767Z [INFO] Waiting until Cloudflare JavaScript challenge is complete.
2025-10-18T22:05:29.313Z [INFO] A Cloudflare turnstile CAPTCHA has appeared, attempting to click through it.
2025-10-18T22:05:29.313Z [DEBUG] Waiting before clicking CAPTCHA to avoid robotic timing. {"wait_ms":2134}
2025-10-18T22:05:31.457Z [DEBUG] Clicking CAPTCHA checkbox. {"click_x":58.5,"click_y":293.6953125}
2025-10-18T22:05:31.617Z [DEBUG] Clicked CAPTCHA checkbox, waiting briefly for verification.
2025-10-18T22:05:34.654Z [INFO] Passed Cloudflare JavaScript check, continuing startup.

[jasonjei]

Sorry, I apologize for not running it with debug. It does see the Captcha checkbox. It clicks it. I took a screenshot too by modifying onstart.js.

2025-10-18T22:08:23.024Z [INFO] A thermoptic onstart hook has been declared, running hook before starting proxy server... {"hook_file":"/work/hooks/onstart.js"}
2025-10-18T22:08:23.909Z [INFO] Waiting until Cloudflare JavaScript challenge is complete.
2025-10-18T22:08:28.527Z [INFO] A Cloudflare turnstile CAPTCHA has appeared, attempting to click through it.
2025-10-18T22:08:28.527Z [DEBUG] Waiting before clicking CAPTCHA to avoid robotic timing. {"wait_ms":1606}
2025-10-18T22:08:30.142Z [DEBUG] Clicking CAPTCHA checkbox. {"click_x":66.5,"click_y":290.6953125}
2025-10-18T22:08:30.305Z [DEBUG] Clicked CAPTCHA checkbox, waiting briefly for verification.
2025-10-18T22:08:32.306Z [DEBUG] Taking screenshot after CAPTCHA click.
2025-10-18T22:08:32.399Z [INFO] Screenshot saved. {"path":"/tmp/captcha_click_1760825312306.png"}
2025-10-18T22:08:33.252Z [INFO] Passed Cloudflare JavaScript check, continuing startup.

diff --git a/hooks/onstart.js b/hooks/onstart.js
index 003704c..719afda 100644
--- a/hooks/onstart.js
+++ b/hooks/onstart.js
@@ -1,5 +1,6 @@
 import CDP from 'chrome-remote-interface';
 import * as logger from '../logger.js';
+import fs from 'fs';

 function get_cdp_config() {
     let port = 9222;
@@ -61,7 +62,7 @@ export async function hook(cdp) {

     // Replace with the site that has the Cloudflare JavaScript check
     // that runs the first time you visit it.
-    await Page.navigate({ url: 'https://example.com/' });
+    await Page.navigate({ url: 'https://www.2captcha.com/demo/cloudflare-turnstile-challenge' });
     await Page.loadEventFired();

     hook_logger.info('Waiting until Cloudflare JavaScript challenge is complete.');
@@ -157,6 +158,14 @@ export async function hook(cdp) {
             hook_logger.debug('Clicked CAPTCHA checkbox, waiting briefly for verification.');
             // Now we wait for the checking action to do something before we rescan
             await sleep((1000 * 2));
+
+            // Take a screenshot after clicking the CAPTCHA
+            hook_logger.debug('Taking screenshot after CAPTCHA click.');
+            const timestamp = Date.now();
+            const screenshot_path = `/tmp/captcha_click_${timestamp}.png`;
+            const screenshot = await Page.captureScreenshot({ format: 'png' });
+            fs.writeFileSync(screenshot_path, Buffer.from(screenshot.data, 'base64'));
+            hook_logger.info('Screenshot saved.', { path: screenshot_path });
         }

         if (!outerHTML.includes(javascript_check_text) && !outerHTML.includes(captcha_solve_required_text)) {

Here's the screenshot:

Possibly not waiting long enough?

[mandatoryprogrammer]

Hmm that is very interesting, thanks for the more verbose output. I'm wondering if Cloudflare is different something different depending on your exit IP 🤔 .

Can you do a screenshot right before:

hook_logger.info('Passed Cloudflare JavaScript check, continuing startup.');

This should tell us at what stage the webpage is at once the hook thinks it is "done".

[jasonjei]

I think that's the screenshot of it. I might try to run it through a Playwright controller and have it stream a video to see what it looks like. I mean, theoretically, it should be the same Chrome browser that you have running that I'm also running. I'm wondering if CloudFlare is delivering me a different TurnStile.

[mandatoryprogrammer]

I'm actually cooking up a branch for thermoptic that will allow you to use the Chrome browser in the container via a web UI. Should be published tomorrow which will make things easier for you to understand what's going on 👍 . (Early code is in the gui-control branch).

[mandatoryprogrammer]

FYI @jasonjei, I've just landed a new thermoptic feature that lets you control and view the Dockerized Chrome browser via a web UI panel: https://github.com/mandatoryprogrammer/thermoptic?tab=readme-ov-file#control-the-dockerized-chrome-browser-via-web-ui-xpra

This should make debugging your situation much more easy. Let me know how it works for you 👍

[jasonjei]

Thank you! I'll debug it later today (or this week). That Web UI panel will be make it much easier to see what's going on since I'm running Thermoptic on a GCP VM instance...

[mandatoryprogrammer]

Sounds good!

[mandatoryprogrammer]

Friendly ping on this 👍

[jasonjei]

Promise I'll look at it before end of this week! I haven't been getting CF challenges when I use Xvfb and headful mode, so it wasn't a huge priority for me to fix 😅

[jasonjei]

Here's a video from my GCP VM trying to solve it, but it doesn't look like it actually clicks the checkbox. It seems like it's being delivered the vanilla TurnStile challenge. Maybe it's trying to solve it before all the elements are ready? Notice that it takes a bit longer for the checkbox to be ready for clicking versus, I don't know, a residential bot test?

Screen.Recording.2025-10-29.at.9.24.24.AM.mov

[mandatoryprogrammer]

Oh, it looks like perhaps onstart.js still has the https://example.com URL in it instead the page you want to solve the CAPTCHA on? You have to modify it to hit the page you want to access.

This is perhaps not very obvious, I have a TODO to have a hook for onrequest that just identifies blocked requests and solves them for arbitrary URLs.