"hash does not match" bug?

[dchandekstark]

Eyeballing the "hash does not match" rejection logs, this is what is typically see:

{"time":"2025-05-28T14:18:44.801580841Z","level":"DEBUG","source":{"function":"github.com/TecharoHQ/anubis/lib.(*Server).PassChallenge","file":"/build/lib/anubis.go","line":356},"msg":"hash does not match","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36","accept_language":"en-US,en;q=0.9","priority":"u=0, i","x-forwarded-for":"[REDACTED]","x-real-ip":"[REDACTED]","check_result":{"name":"bot/generic-browser","rule":"CHALLENGE"},"got":"00008c16d6cc14ff97e77e175c6b636d1b89ada9623529d34a737f10e11d6d9a","want":"578a84a85193159a79720a188f0c40a80a8761ff6099ee2bb82106186e5048d6"}

At difficulty 4 It appears that the "want" value is incorrect, if I understand the process. Is this a possible bug?

[Xe]

That is quite strange. Is the IP address IPv4 or IPv6?

[dchandekstark]

IPv4

[seanaery]

Unsure if this is at all related, but I notice that in cases where we're getting "hash does not match" for a likely real non-bot user, the accept_language value is inconsistently reported for the same IP/user agent combo as they progress through the challenge.

Three messages (with IPv4 redacted) in rapid succession for the same user:

Cookie Not Found:
"accept_language":"en-US"

{"time":"2025-05-28T04:05:50.218738164Z","level":"DEBUG","source":{"function":"github.com/TecharoHQ/anubis/lib.(*Server).maybeReverseProxy","file":"/build/lib/anubis.go","line":129},"msg":"cookie not found","user_agent":"Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Mobile Safari/537.36","accept_language":"en-US","priority":"u=0, i","x-forwarded-for":"[REDACTED]","x-real-ip":"[REDACTED]","check_result":{"name":"bot/generic-browser","rule":"CHALLENGE"},"path":"/[REDACTED]"}

Challenge Took:
"accept_language":"en-US,en;q=0.9"

{"time":"2025-05-28T04:05:51.801742504Z","level":"INFO","source":{"function":"github.com/TecharoHQ/anubis/lib.(*Server).PassChallenge","file":"/build/lib/anubis.go","line":319},"msg":"challenge took","user_agent":"Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Mobile Safari/537.36","accept_language":"en-US,en;q=0.9","priority":"u=0, i","x-forwarded-for":"[REDACTED]","x-real-ip":"[REDACTED]","check_result":{"name":"bot/generic-browser","rule":"CHALLENGE"},"elapsedTime":1303}

Hash Does Not Match:
"accept_language":"en-US,en;q=0.9"

{"time":"2025-05-28T04:05:51.80187225Z","level":"DEBUG","source":{"function":"github.com/TecharoHQ/anubis/lib.(*Server).PassChallenge","file":"/build/lib/anubis.go","line":356},"msg":"hash does not match","user_agent":"Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Mobile Safari/537.36","accept_language":"en-US,en;q=0.9","priority":"u=0, i","x-forwarded-for":"[REDACTED]","x-real-ip":"[REDACTED]","check_result":{"name":"bot/generic-browser","rule":"CHALLENGE"},"got":"00001fd3a1b37b70c031e04ad140af8ec4a8c3946951757d829237e292b1209a","want":"0a18f157804941742db6f83f142cb4f64272e0e32aa1540f25254f28caf82a07"}

[Xe]

Huh? That's strange. Why would the user agent be doing that?

I'll make a PR that handles the accept-language string better after work.

[dchandekstark]

@Xe Should we roll this into an issue?

[Xe]

Yes, I think I did fix this before release, but to be sure open an issue.