MetaMask / MetaMask/metamask-mobile

MetaMask's mobile browser fails Cloudflare checks

Open
#11,147 0 comments 2 reactions 0 assignees View on GitHub
external-contributor
Dominant language
TypeScript
Stars
3k
Forks
1.7k
Avg merge
1d 14h
Merged PRs (30d)
669

Description

### What is this about?

We've had several of our users report that MetaMask mobile users aren't able to pass Cloudflare validations anymore. Seems to be a relatively recent phenomenon to us, as we haven't experienced it before. I've been able to recreate the issue as well (on iPhone), both on our site, and on Cloudflare's own website. It was relatively simple:

1. Go to dash.cloudflare.com
2. Don't fill out any login information, wait for the Cloudflare verification checkbox to appear
3. Try checking it off -- it should fail, and you won't be able to proceed

Cloudflare is used on a lot of Web3 sites, so I would imagine supporting it is crucial.

Example:
![IMG_3305](https://github.com/user-attachments/assets/d70bad35-255c-417f-b50b-5a2a806ec13a)

### Scenario

_No response_

### Design

_No response_

### Technical Details

We've found reports from other people that have filed to Cloudflare, where Cloudflare details the nature of the issue further.
https://community.cloudflare.com/t/under-attack-mode-enabled-metamast-app-browser-users-see-security-page-keeps-redirecting/412228

### Threat Modeling Framework

_No response_

### Acceptance Criteria

_No response_

### Stakeholder review needed before the work gets merged

- [X] Engineering (needed in most cases)
- [ ] Design
- [ ] Product
- [ ] QA (automation tests are required to pass before merging PRs but not all changes are covered by automation tests - please review if QA is needed beyond automation tests)
- [ ] Security
- [ ] Legal
- [ ] Marketing
- [ ] Management (please specify)
- [ ] Other (please specify)

### References

_No response_

Contributor guide

Open the contributing guide

Research direction

Reproduce the failure in the MetaMask mobile browser on iPhone using dash.cloudflare.com and the checkbox steps in the issue, then review the linked Cloudflare report. No source files, tests, or entry points are identified in the payload; the issue has no acceptance criteria, so completion would require demonstrating that Cloudflare validation succeeds in the affected mobile-browser scenario.

Written by the indexing model from the issue text.

Assessment

Tech stack
react-native, typescript
Domain
mobile, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.