Hacker News Reader

Did I miss something? I don't understand what the "non-interactive challenge" is here:

> The widget takes responsibility for running the non-interactive challenge and returning a token

I get that a widget can return a token and then you trust the token and do the rest. But what determines whether a caller receives a tokens or not? That is, what's the actual challenge? That is, how is the distinction between bot vs. real human user actually getting decided?

View on HN

If you're just pinging the endpoint without providing the necessary header then you are effectively a bot in this case. If you go through the motions to fill out the form and then submit it you're at least not explicitly telling the service you are going against its wishes by pinging the API directly.

As for the challenge, that seems to be within Cloudflare's implementation which then returns the token to submit with the form. HIBP then verifies the token to make sure its a match before checking for the data and sending a response.

Probably a form of proof of work which is costly for the bots but fair on normal users (combined with normal fingerprinting and IP check which determines how hard the challenge should be for a request)

Reply on news.ycombinator.com