Please consider skipping the Anubis check when a user is already logged in

8 months ago by who to c/main

Dear admins,

I see that feddit has adopted Anubis for bot protection. I'm glad it was chosen instead of Cloudflare (or some other invasive service).

However, having to wait for the Anubis check before I can use the site is annoying, especially when I'm already logged in. And it happens multiple times per day, amplifying the feeling that my time is being wasted.

Will you please consider skipping the Anubis check when my browser already has a valid login cookie?

Thank you.

feddit 24 points 8 months ago

@who@feddit.org : this is sadly not possible, as Anubis knows nothing about the user session or login status of the user within Lemmy (or cookies for that matter). It's a tool that does heuristic checks, taking into account e.g. the IP address, the browsers user-agent header etc. It however stores sessions it has "seen" for 12h (with its own cookie) and doesn't send a challenge as long as this is persisted.

If you're seeing the challenge multiple times a day, that this usually means that the cookie either was deleted, or the session somehow otherwise got interrupted on the client side.

save

path: 0 21896759, hotness: undefined, score: 24, children: 6

who 1 point 8 months ago

It however stores sessions it has “seen” for 12h

Wow; that's surprisingly short. That means I get hit with Anubis at least six times a day when I use three browsers, and eight times a day when I use four. I often do switch between devices throughout the day, so I think this explains it.

If it can't be made login-aware, how about extending the session time to 24 or 48 hours? That would at least reduce the continual annoyances that some of us are now experiencing.

save

path: 0 21896759 21905595, hotness: undefined, score: 1, children: 1

surprised_pikachu 6 points 8 months ago

we're currently working on building some dashboards to visualize the effectiveness of anubis. once we have this setup we'll try tuning some settings and hopefully be able to measure the effectiveness of said tuning.

save

path: 0 21896759 21905595 22091522, hotness: undefined, score: 6, children: 0

gandalf_der_12te 1 point 8 months ago

could we maybe increase the session persistence time to 3 days then? i have the same issue as OP

save

path: 0 21896759 21899075, hotness: undefined, score: 1, children: 3

LOLseas 3 points 8 months ago

Why limit to 3 days when we can increase it to 8?

save

path: 0 21896759 21899075 21899417, hotness: undefined, score: 3, children: 2

Speiser0 2 points 8 months ago

Why limit to 8 days when we can increase it to 16?

save

path: 0 21896759 21899075 21899417 21901052, hotness: undefined, score: 2, children: 1

Tarogar 4 points 8 months ago

If we just remove Anubis we don't need to worry about time limits for sessions...

Oh wait I think that defeats the purpose of Anubis in the first place. Almost like it has these short session lengths for a reason. But I am not an expert.

save

path: 0 21896759 21899075 21899417 21901052 21905221, hotness: undefined, score: 4, children: 0

b_tr3e 2 points 8 months ago

You're lucky. For it has been a gamble to log in for days. Same browser as always but no progress, "checking" forever...

save

path: 0 22133314, hotness: undefined, score: 2, children: 0