• Welcome to the Chevereto User Community!

    Here, users from all over the world come together to learn, share, and collaborate on everything related to Chevereto. It's a place to exchange ideas, ask questions, and help improve the software.

    Please keep in mind:

    • This community is user-driven. Always be polite and respectful to others.
    • Support development by purchasing a Chevereto license, which also gives you priority support.
    • Go further by joining the Community Subscription for even faster response times and to help sustain this space
  • Chevereto Support CLST

    Support response

    Support checklist

    • Got a Something went wrong message? Read this guide and provide the actual error. Do not skip this.
    • Confirm that the server meets the System Requirements
    • Check for any available Hotfix - your issue could be already reported/fixed
    • Read documentation - It will be required to Debug and understand Errors for a faster support response

Blocked - license validation request

Version
4.5.4
Website URL
https://lookimg.com
PHP version
8.2.30
Database driver
MariaDB
Database version
NA
Web browser
Chrome
L

Logan

Chevereto Member
Issue Summary:

When "Save License" is clicked in the Chevereto admin dashboard, the application sends a license validation request from the VPS to https://chevereto.com/api/license/check.

The request is being intercepted by Cloudflare, which returns a JavaScript challenge page (response header: cf-mitigated: challenge) because the request originates from a server-side cURL client rather than a browser with JavaScript support.

As a result, Chevereto receives HTML content instead of the expected JSON response. The subsequent json_decode() operation returns null, and the application crashes when attempting to access $check->data, resulting in a license validation failure.
 
Sort by date Sort by votes
If you manage the Cloudflare zone for chevereto.com, you can bypass the challenge for the license-check endpoint using a WAF custom rule.

Option 1: Create a WAF Custom Rule (Recommended)​

  1. Log in to Cloudflare Dashboard.
  2. Select the domain (chevereto.com).
  3. Go to Security → WAF → Custom Rules.
  4. Click Create Rule.
  5. Configure:
Rule Name

Bypass License Check API<br>
Expression

(http.request.uri.path eq "/api/license/check")<br>
Action

Skip<br>
Skip:

  • WAF Managed Rules
  • Super Bot Fight Mode
  • Rate Limiting (if applicable)
  • Browser Integrity Check
  1. Save and deploy.

Option 2: Bypass for Specific Source IPs​

If only certain VPS IPs need access:

Expression

(http.request.uri.path eq "/api/license/check" and ip.src in {YOUR_VPS_IP})<br>
Example:

(http.request.uri.path eq "/api/license/check" and ip.src in {203.0.113.10})<br>
Action:

Skip<br>
This is more secure than bypassing for everyone.

Option 3: Disable Challenge on API Paths​

If a Managed Challenge rule exists:

  1. Go to Security → WAF.
  2. Find the rule applying Managed Challenge.
  3. Add an exception:
http.request.uri.path eq "/api/license/check"<br>

Verify​

From the VPS:

curl -I https://chevereto.com/api/license/check<br>
The response should no longer contain:

cf-mitigated: challenge<br>
and the endpoint should return JSON instead of a Cloudflare challenge page.

If you don't own the Cloudflare configuration for chevereto.com (which is likely if you're just using Chevereto), you'll need to ask the Chevereto team to create the bypass rule on their Cloudflare account, as you cannot configure it from your VPS.
 
Upvote 0 Downvote
We are under a DDoS attack, plus the usual high load driven from bots and AI crawlers. I don't know how long will take, give it a try later.
 
Upvote 0 Downvote
You must log in or register to reply here.
Back
Top