Ajax infinite scroll when behind reverse proxy (CloudFlare)

We have notices a small bug but would be nice to get it fixed.

When a page using any “infinite scroll” modules gets in cache (here on CloudFlare), when a logged in user triggers the “load more” (same thing happens with infinite scroll) the ajax request gets bounced with “forbidden”

POST https://www.mysite.com/wp-admin/admin-ajax.php?td_theme_name=Newspaper&v=12.3.1

Returns status 403
the response body is: -1

When navigating in “private mode” (so without the auth cookie) it all works fine.
It would be a nice thing to see fixed
CloudFlare isn’t an uncommon thing to use these days and using the free version it doesn’t seem possible to bypass their cache based on presence of the auth cookie.

Thank you for looking into this. It’s probably a small thing to fix.

Antony GIBBS

It is not Clouflare returning error.

It seems the ajax call is authenticated (and being a POST not cache-able)
And that the request was built form a page stored in cache (from a not authenticated request)

I get this in the server logs:

xxx.xxx.xxx.xxx - - [03/Jun/2023:04:37:40 +0200] "POST www.welovetennis.fr/wp-admin/admin-ajax.php?td_theme_name=Newspaper&v=12.3.1 HTTP/2.0" 403 22 "https://www.welovetennis.fr/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36" 0.207 0.202 . -


When using a cache plugin in WordPress (aka W3-TotalCache or other), it will disable the cache for authenticated users and build the page for all known users.

But when using ClouFlare, when page is in cache, admin users get same page as everybody.

So navigating on the frontend of the site admins have time to time the wordpress admin-bar (cf cache miss) and no admin-bar (cf cache HIT)

So when admins do have the admin bar the infinite scroll works as expected, but on pages without the admin-bar (cf cache HIT) the Ajax request reaches the server and bounces status 403.

Bellow you’ll find the request in curl
If I run that request without the line “-H ‘cookie’ … ” it works just fine.
So I believe the payload / ‘–data-raw’ section holds something about the authenticated user that has to match the cookie, and that when it finds the cookie and not the relevant data in the payload, the request gets rejected.
(I’ve tested all I could. Things like disabling any security plugins like Wordfence etc..)


curl 'https://www.welovetennis.fr/wp-admin/admin-ajax.php?td_theme_name=Newspaper&v=12.3.1' \
-H 'authority: www.welovetennis.fr' \
-H 'accept: */*' \
-H 'accept-language: fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7,es-419;q=0.6,es;q=0.5' \
-H 'content-type: application/x-www-form-urlencoded; charset=UTF-8' \
-H 'cookie: wordpress_sec_f1bdf72b037f4fc61a63ad5e89e9ef25=antony%7C1686083014%7CURpjXWj39EjnJJRGKPumlEmrKcrFlVet04mQNF1ntDn%7C4856477bbdf40dcf110a94ce8fe959667a535a667b2568634a269f62cd4dfb87; wordpress_logged_in_f1bdf72b037f4fxxxxxxxxxx25=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxf6fb09ef8ae5; wp-settings-1=editor%3Dhtml%26libraryContent%3Dbrowse%26advImgDetails%3Dshow%26posts_list_mode%3Dlist%26imgsize%3Dfull%26mfold%3Do; wp-settings-time-1=1684873423; fonce_current_user=1; _ga_1Z908S1EE2=GS1.1.1685172078.1.0.1685172078.0.0.0; _pbjs_userid_consent_data=1688550979652389; _gid=GA1.2.1338529052.1685759630; hidecta=no; _ga_98EFBCYPM8=GS1.1.1685759629.9.1.1685759860.0.0.0; cto_bundle=8djCU19DMGVlRWxiSUdyMVQ2M0hDa3BwQ05BYmNHQnFIcEFHTFU3VzhlWkdQbDlndVNmb3FKb0JOT1ZGUkhzciUyQlQ5MHBnb1dRNGIyTFdEMTBFd0lCM25tclZaNUFJZXRuY3FSSktJdkJLNzFvSSUyRlJqZyUyRkRYbVhPckhISlZ3aUNOaVNvMnJCZHBOdVZGR0FsSlFwJTJGU1pYek0lMkZnJTNEJTNE; cto_bidid=_sEKgV82RWp4YkNYZWFVejBnTXNHVG0yOUgxcHRhSXZEa0lwdEFEalJTdU93ZDglMkZQYVFkOGhTWHRRbjdvdDJRRk5SZSUyRlV0dmpSOVpXTDZYM0dySmhwUHdmbmNWNHpkYmpuV211OXJpYVlYYmtVWGNkaGJtQk5KNklueHNaN3hxTWhNMjU; _ga=GA1.2.1020367004.1684952847; _gat=1' \
-H 'dnt: 1' \
-H 'origin: https://www.welovetennis.fr' \
-H 'referer: https://www.welovetennis.fr/' \
-H 'sec-ch-ua: "Google Chrome";v="113", "Chromium";v="113", "Not-A.Brand";v="24"' \
-H 'sec-ch-ua-mobile: ?0' \
-H 'sec-ch-ua-platform: "Linux"' \
-H 'sec-fetch-dest: empty' \
-H 'sec-fetch-mode: cors' \
-H 'sec-fetch-site: same-origin' \
-H 'user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36' \
-H 'x-requested-with: XMLHttpRequest' \
--data-raw 'action=td_ajax_block&td_atts=%7B%22art_title_pos%22%3A%22bottom%22%2C%22info_pos%22%3A%22bottom%22%2C%22art_excerpt_pos%22%3A%22bottom%22%2C%22art_audio_pos%22%3A%22bottom%22%2C%22modules_category%22%3A%22image%22%2C%22btn_pos%22%3A%22bottom%22%2C%22modules_on_row%22%3A%22eyJhbGwiOiI1MCUiLCJwaG9uZSI6IjEwMCUiLCJwb3J0cmFpdCI6IjEwMCUifQ%3D%3D%22%2C%22category_ids%22%3A%22346%22%2C%22limit%22%3A%224%22%2C%22ajax_pagination%22%3A%22infinite%22%2C%22sort%22%3A%22%22%2C%22offset%22%3A%223%22%2C%22ajax_pagination_infinite_stop%22%3A%223%22%2C%22tdc_css%22%3A%22eyJwaG9uZSI6eyJkaXNwbGF5IjoiIn0sInBob25lX21heF93aWR0aCI6NzY3fQ%3D%3D%22%2C%22show_btn%22%3A%22%22%2C%22td_ajax_preloading%22%3A%22%22%2C%22show_review%22%3A%22none%22%2C%22show_com%22%3A%22none%22%2C%22time_ago_add_txt%22%3A%22%22%2C%22block_type%22%3A%22td_flex_block_5%22%2C%22separator%22%3A%22%22%2C%22custom_title%22%3A%22%22%2C%22custom_url%22%3A%22%22%2C%22block_template_id%22%3A%22%22%2C%22title_tag%22%3A%22%22%2C%22mc5_tl%22%3A%22%22%2C%22mc5_title_tag%22%3A%22%22%2C%22mc5_el%22%3A%22%22%2C%22post_ids%22%3A%22%22%2C%22category_id%22%3A%22%22%2C%22taxonomies%22%3A%22%22%2C%22in_all_terms%22%3A%22%22%2C%22tag_slug%22%3A%22%22%2C%22autors_id%22%3A%22%22%2C%22installed_post_types%22%3A%22%22%2C%22open_in_new_window%22%3A%22%22%2C%22show_modified_date%22%3A%22%22%2C%22time_ago%22%3A%22%22%2C%22time_ago_txt_pos%22%3A%22%22%2C%22el_class%22%3A%22%22%2C%22td_query_cache%22%3A%22%22%2C%22td_query_cache_expiration%22%3A%22%22%2C%22td_ajax_filter_type%22%3A%22%22%2C%22td_ajax_filter_ids%22%3A%22%22%2C%22td_filter_default_txt%22%3A%22All%22%2C%22modules_gap%22%3A%22%22%2C%22m_padding%22%3A%22%22%2C%22all_modules_space%22%3A%2236%22%2C%22modules_border_size%22%3A%22%22%2C%22modules_border_style%22%3A%22%22%2C%22modules_border_color%22%3A%22%23eaeaea%22%2C%22modules_divider%22%3A%22%22%2C%22divider_on%22%3A%22%22%2C%22modules_divider_color%22%3A%22%23eaeaea%22%2C%22h_effect%22%3A%22%22%2C%22image_size%22%3A%22%22%2C%22image_alignment%22%3A%2250%22%2C%22image_height%22%3A%22%22%2C%22image_radius%22%3A%22%22%2C%22image_margin%22%3A%22%22%2C%22hide_image%22%3A%22%22%2C%22video_icon%22%3A%22%22%2C%22video_popup%22%3A%22yes%22%2C%22video_rec%22%3A%22%22%2C%22spot_header%22%3A%22%22%2C%22video_rec_title%22%3A%22%22%2C%22video_rec_color%22%3A%22%22%2C%22video_rec_disable%22%3A%22%22%2C%22autoplay_vid%22%3A%22yes%22%2C%22show_vid_t%22%3A%22block%22%2C%22vid_t_margin%22%3A%22%22%2C%22vid_t_padding%22%3A%22%22%2C%22video_title_color%22%3A%22%22%2C%22video_title_color_h%22%3A%22%22%2C%22video_bg%22%3A%22%22%2C%22video_overlay%22%3A%22%22%2C%22vid_t_color%22%3A%22%22%2C%22vid_t_bg_color%22%3A%22%22%2C%22f_vid_title_font_header%22%3A%22%22%2C%22f_vid_title_font_title%22%3A%22Video+pop-up+article+title%22%2C%22f_vid_title_font_settings%22%3A%22%22%2C%22f_vid_title_font_family%22%3A%22%22%2C%22f_vid_title_font_size%22%3A%22%22%2C%22f_vid_title_font_line_height%22%3A%22%22%2C%22f_vid_title_font_style%22%3A%22%22%2C%22f_vid_title_font_weight%22%3A%22%22%2C%22f_vid_title_font_transform%22%3A%22%22%2C%22f_vid_title_font_spacing%22%3A%22%22%2C%22f_vid_title_%22%3A%22%22%2C%22f_vid_time_font_title%22%3A%22Video+duration+text%22%2C%22f_vid_time_font_settings%22%3A%22%22%2C%22f_vid_time_font_family%22%3A%22%22%2C%22f_vid_time_font_size%22%3A%22%22%2C%22f_vid_time_font_line_height%22%3A%22%22%2C%22f_vid_time_font_style%22%3A%22%22%2C%22f_vid_time_font_weight%22%3A%22%22%2C%22f_vid_time_font_transform%22%3A%22%22%2C%22f_vid_time_font_spacing%22%3A%22%22%2C%22f_vid_time_%22%3A%22%22%2C%22meta_info_horiz%22%3A%22content-horiz-left%22%2C%22meta_width%22%3A%22%22%2C%22meta_margin%22%3A%22%22%2C%22meta_margin2%22%3A%22%22%2C%22meta_padding%22%3A%22%22%2C%22meta_padding2%22%3A%22%22%2C%22meta_info_border_size%22%3A%22%22%2C%22meta_info_border_size2%22%3A%22%22%2C%22meta_info_border_style%22%3A%22%22%2C%22meta_info_border_color%22%3A%22%23eaeaea%22%2C%22meta_info_border_radius%22%3A%22%22%2C%22meta_info_border_radius2%22%3A%22%22%2C%22info_space%22%3A%22%22%2C%22art_title%22%3A%22%22%2C%22show_excerpt%22%3A%22block%22%2C%22art_excerpt%22%3A%22%22%2C%22excerpt_inline%22%3A%22%22%2C%22meta_space%22%3A%22%22%2C%22show_audio%22%3A%22block%22%2C%22hide_audio%22%3A%22%22%2C%22art_audio%22%3A%22%22%2C%22art_audio_size%22%3A%221.5%22%2C%22show_cat%22%3A%22inline-block%22%2C%22modules_category_margin%22%3A%22%22%2C%22modules_category_padding%22%3A%22%22%2C%22modules_category_border%22%3A%22%22%2C%22modules_category_radius%22%3A%220%22%2C%22modules_extra_cat%22%3A%22%22%2C%22show_author%22%3A%22inline-block%22%2C%22author_photo%22%3A%22%22%2C%22author_photo_size%22%3A%22%22%2C%22author_photo_space%22%3A%22%22%2C%22author_photo_radius%22%3A%22%22%2C%22show_date%22%3A%22inline-block%22%2C%22review_space%22%3A%22%22%2C%22review_size%22%3A%222.5%22%2C%22review_distance%22%3A%22%22%2C%22btn_title%22%3A%22%22%2C%22btn_margin%22%3A%22%22%2C%22btn_padding%22%3A%22%22%2C%22btn_border_width%22%3A%22%22%2C%22btn_radius%22%3A%22%22%2C%22pag_space%22%3A%22%22%2C%22pag_padding%22%3A%22%22%2C%22pag_border_width%22%3A%22%22%2C%22pag_border_radius%22%3A%22%22%2C%22prev_tdicon%22%3A%22%22%2C%22next_tdicon%22%3A%22%22%2C%22pag_icons_size%22%3A%22%22%2C%22f_header_font_header%22%3A%22%22%2C%22f_header_font_title%22%3A%22Block+header%22%2C%22f_header_font_settings%22%3A%22%22%2C%22f_header_font_family%22%3A%22%22%2C%22f_header_font_size%22%3A%22%22%2C%22f_header_font_line_height%22%3A%22%22%2C%22f_header_font_style%22%3A%22%22%2C%22f_header_font_weight%22%3A%22%22%2C%22f_header_font_transform%22%3A%22%22%2C%22f_header_font_spacing%22%3A%22%22%2C%22f_header_%22%3A%22%22%2C%22f_ajax_font_title%22%3A%22Ajax+categories%22%2C%22f_ajax_font_settings%22%3A%22%22%2C%22f_ajax_font_family%22%3A%22%22%2C%22f_ajax_font_size%22%3A%22%22%2C%22f_ajax_font_line_height%22%3A%22%22%2C%22f_ajax_font_style%22%3A%22%22%2C%22f_ajax_font_weight%22%3A%22%22%2C%22f_ajax_font_transform%22%3A%22%22%2C%22f_ajax_font_spacing%22%3A%22%22%2C%22f_ajax_%22%3A%22%22%2C%22f_more_font_title%22%3A%22Load+more+button%22%2C%22f_more_font_settings%22%3A%22%22%2C%22f_more_font_family%22%3A%22%22%2C%22f_more_font_size%22%3A%22%22%2C%22f_more_font_line_height%22%3A%22%22%2C%22f_more_font_style%22%3A%22%22%2C%22f_more_font_weight%22%3A%22%22%2C%22f_more_font_transform%22%3A%22%22%2C%22f_more_font_spacing%22%3A%22%22%2C%22f_more_%22%3A%22%22%2C%22f_title_font_header%22%3A%22%22%2C%22f_title_font_title%22%3A%22Article+title%22%2C%22f_title_font_settings%22%3A%22%22%2C%22f_title_font_family%22%3A%22%22%2C%22f_title_font_size%22%3A%22%22%2C%22f_title_font_line_height%22%3A%22%22%2C%22f_title_font_style%22%3A%22%22%2C%22f_title_font_weight%22%3A%22%22%2C%22f_title_font_transform%22%3A%22%22%2C%22f_title_font_spacing%22%3A%22%22%2C%22f_title_%22%3A%22%22%2C%22f_cat_font_title%22%3A%22Article+category+tag%22%2C%22f_cat_font_settings%22%3A%22%22%2C%22f_cat_font_family%22%3A%22%22%2C%22f_cat_font_size%22%3A%22%22%2C%22f_cat_font_line_height%22%3A%22%22%2C%22f_cat_font_style%22%3A%22%22%2C%22f_cat_font_weight%22%3A%22%22%2C%22f_cat_font_transform%22%3A%22%22%2C%22f_cat_font_spacing%22%3A%22%22%2C%22f_cat_%22%3A%22%22%2C%22f_meta_font_title%22%3A%22Article+meta+info%22%2C%22f_meta_font_settings%22%3A%22%22%2C%22f_meta_font_family%22%3A%22%22%2C%22f_meta_font_size%22%3A%22%22%2C%22f_meta_font_line_height%22%3A%22%22%2C%22f_meta_font_style%22%3A%22%22%2C%22f_meta_font_weight%22%3A%22%22%2C%22f_meta_font_transform%22%3A%22%22%2C%22f_meta_font_spacing%22%3A%22%22%2C%22f_meta_%22%3A%22%22%2C%22f_ex_font_title%22%3A%22Article+excerpt%22%2C%22f_ex_font_settings%22%3A%22%22%2C%22f_ex_font_family%22%3A%22%22%2C%22f_ex_font_size%22%3A%22%22%2C%22f_ex_font_line_height%22%3A%22%22%2C%22f_ex_font_style%22%3A%22%22%2C%22f_ex_font_weight%22%3A%22%22%2C%22f_ex_font_transform%22%3A%22%22%2C%22f_ex_font_spacing%22%3A%22%22%2C%22f_ex_%22%3A%22%22%2C%22f_btn_font_title%22%3A%22Article+read+more+button%22%2C%22f_btn_font_settings%22%3A%22%22%2C%22f_btn_font_family%22%3A%22%22%2C%22f_btn_font_size%22%3A%22%22%2C%22f_btn_font_line_height%22%3A%22%22%2C%22f_btn_font_style%22%3A%22%22%2C%22f_btn_font_weight%22%3A%22%22%2C%22f_btn_font_transform%22%3A%22%22%2C%22f_btn_font_spacing%22%3A%22%22%2C%22f_btn_%22%3A%22%22%2C%22mix_color%22%3A%22%22%2C%22mix_type%22%3A%22%22%2C%22fe_brightness%22%3A%221%22%2C%22fe_contrast%22%3A%221%22%2C%22fe_saturate%22%3A%221%22%2C%22mix_color_h%22%3A%22%22%2C%22mix_type_h%22%3A%22%22%2C%22fe_brightness_h%22%3A%221%22%2C%22fe_contrast_h%22%3A%221%22%2C%22fe_saturate_h%22%3A%221%22%2C%22m_bg%22%3A%22%22%2C%22shadow_shadow_header%22%3A%22%22%2C%22shadow_shadow_title%22%3A%22Module+Shadow%22%2C%22shadow_shadow_size%22%3A%22%22%2C%22shadow_shadow_offset_horizontal%22%3A%22%22%2C%22shadow_shadow_offset_vertical%22%3A%22%22%2C%22shadow_shadow_spread%22%3A%22%22%2C%22shadow_shadow_color%22%3A%22%22%2C%22meta_bg%22%3A%22%22%2C%22meta_bg2%22%3A%22%22%2C%22title_txt%22%3A%22%22%2C%22title_txt_hover%22%3A%22%22%2C%22all_underline_height%22%3A%22%22%2C%22all_underline_color%22%3A%22%23000%22%2C%22cat_bg%22%3A%22%22%2C%22cat_bg_hover%22%3A%22%22%2C%22cat_txt%22%3A%22%22%2C%22cat_txt_hover%22%3A%22%22%2C%22cat_border%22%3A%22%22%2C%22cat_border_hover%22%3A%22%22%2C%22author_txt%22%3A%22%22%2C%22author_txt_hover%22%3A%22%22%2C%22date_txt%22%3A%22%22%2C%22ex_txt%22%3A%22%22%2C%22com_bg%22%3A%22%22%2C%22com_txt%22%3A%22%22%2C%22rev_txt%22%3A%22%22%2C%22shadow_m_shadow_header%22%3A%22%22%2C%22shadow_m_shadow_title%22%3A%22Meta+info+shadow%22%2C%22shadow_m_shadow_size%22%3A%22%22%2C%22shadow_m_shadow_offset_horizontal%22%3A%22%22%2C%22shadow_m_shadow_offset_vertical%22%3A%22%22%2C%22shadow_m_shadow_spread%22%3A%22%22%2C%22shadow_m_shadow_color%22%3A%22%22%2C%22audio_btn_color%22%3A%22%22%2C%22audio_time_color%22%3A%22%22%2C%22audio_bar_color%22%3A%22%22%2C%22audio_bar_curr_color%22%3A%22%22%2C%22btn_bg%22%3A%22%22%2C%22btn_bg_hover%22%3A%22%22%2C%22btn_txt%22%3A%22%22%2C%22btn_txt_hover%22%3A%22%22%2C%22btn_border%22%3A%22%22%2C%22btn_border_hover%22%3A%22%22%2C%22pag_text%22%3A%22%22%2C%22pag_h_text%22%3A%22%22%2C%22pag_bg%22%3A%22%22%2C%22pag_h_bg%22%3A%22%22%2C%22pag_border%22%3A%22%22%2C%22pag_h_border%22%3A%22%22%2C%22ajax_pagination_next_prev_swipe%22%3A%22%22%2C%22css%22%3A%22%22%2C%22td_column_number%22%3A1%2C%22header_color%22%3A%22%22%2C%22color_preset%22%3A%22%22%2C%22border_top%22%3A%22%22%2C%22class%22%3A%22tdi_85%22%2C%22tdc_css_class%22%3A%22tdi_85%22%2C%22tdc_css_class_style%22%3A%22tdi_85_rand_style%22%7D&td_block_id=tdi_85&td_column_number=1&td_current_page=2&block_type=td_flex_block_5&td_filter_value=&td_user_action=&td_magic_token=3380c233f7' \
--compressed


• This reply was modified 3 years by cantoute.

BTW

Are they aware that one can install and run it’s private GitLab ?

I suffer for you guys working all year long using this editor ?

Hi,

Thank you for investigating.
I did some research too and pretty sure the problem is in the way it is managed by the theme. We have no issue with any other Ajax requests (including other WP projects using CF + Rest + GraphQL).
In the meantime I found a work around.
There is a setting in CloudFlare in the Cache section to set a rule to bypass cache in presence of a cookie. This way the authors can navigate in the site without the “loader” jamming 🙂

I still hope the devs find the fix, would be nice for others too.
But what would be even nicer is that those requests could use GET … opening the magics of cache <3
Saturday http://www.welovetennis.fr hit over 1 million visits… not easy to handle such load without cache.

Fingers crossed 🙂
Thanks for reading and wish you all a nice day.

reminder: in previous messages, logs confirmed that the POST request did get to the backend and that it was the backend responding 403, not cf.

• This reply was modified 3 years by cantoute.