MetaMask / MetaMask/metamask-mobile
MetaMask's mobile browser fails Cloudflare checks
- Dominant language
- TypeScript
- Stars
- 3k
- Forks
- 1.7k
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 669
Description
### What is this about?
We've had several of our users report that MetaMask mobile users aren't able to pass Cloudflare validations anymore. Seems to be a relatively recent phenomenon to us, as we haven't experienced it before. I've been able to recreate the issue as well (on iPhone), both on our site, and on Cloudflare's own website. It was relatively simple:
1. Go to dash.cloudflare.com
2. Don't fill out any login information, wait for the Cloudflare verification checkbox to appear
3. Try checking it off -- it should fail, and you won't be able to proceed
Cloudflare is used on a lot of Web3 sites, so I would imagine supporting it is crucial.
Example:

### Scenario
_No response_
### Design
_No response_
### Technical Details
We've found reports from other people that have filed to Cloudflare, where Cloudflare details the nature of the issue further.
https://community.cloudflare.com/t/under-attack-mode-enabled-metamast-app-browser-users-see-security-page-keeps-redirecting/412228
### Threat Modeling Framework
_No response_
### Acceptance Criteria
_No response_
### Stakeholder review needed before the work gets merged
- [X] Engineering (needed in most cases)
- [ ] Design
- [ ] Product
- [ ] QA (automation tests are required to pass before merging PRs but not all changes are covered by automation tests - please review if QA is needed beyond automation tests)
- [ ] Security
- [ ] Legal
- [ ] Marketing
- [ ] Management (please specify)
- [ ] Other (please specify)
### References
_No response_
Contributor guide
Research direction
Reproduce the failure in the MetaMask mobile browser on iPhone using dash.cloudflare.com and the checkbox steps in the issue, then review the linked Cloudflare report. No source files, tests, or entry points are identified in the payload; the issue has no acceptance criteria, so completion would require demonstrating that Cloudflare validation succeeds in the affected mobile-browser scenario.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- react-native, typescript
- Domain
- mobile, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100