Skip to main content

Normal flow (without t parameter)

warning

Countless backend errors? Please report them to us and we will attempt to resolve your issue as soon as possible!

SBSD normal flow can be identified by the absence of t parameter in the script URL. You also won't see any challenge response, but instead a normal page response with a script tag containing v parameter.

It's immediately solved and the payload is sent back to the same endpoint that served the script, BUT without v parameter. Request contains a JSON {"body":"JDSK73?/sdf..."} characteristic to SBSD. After the payload is sent, you shouldn't be SBSD blocked on the same User-Agent and IP for a while.

As opposed to challenge flow, normal flow consists of 2 separate POST requests, however we've noticed that the second POST often has limited effect on success rate, so you can skip it if you want to save time and bandwidth and only perform it if you are still SBSD blocked after the first POST.

Akamai Web V3 still has to be solved to obtain a valid _abck cookie.

Key customer-side detection vectors​

  1. Proxies - Akamai is very sensitive to proxy quality. At very least, use a sticky/static proxy from country of app's target audience. We recommend using a high-quality residential or ISP proxy provider.
  2. TLS fingerprint - Your HTTP client must match the TLS fingerprint of the target platform.
  3. Header order - Header order must match real requests' one. Use HTTP proxy to inspect the actual request/response bodies.

If any of those are unfamiliar to you, please visit Getting started for more information.

Flow​

info

Remember to maintain the same HTTP client, cookie jar, proxy and correct headers, header order across the full flow. Otherwise, you will be blocked by SBSD.
Your interaction must appear as a single, coherent HTTP session to the target server.

1. Initial page request​

Make a GET request to the target page; homepage, product page, etc. The response will contain a script tag with v query parameter. This is the SBSD script that you need to parse and solve.

2. Parse the script URL​

Extract the script URL from the response. It will look something like this:

https://example.com/oh9-FCgd0/yhU7kLks/Ff0U2kh_/4s/Xz9OG03zOm9L/Hkg8dEgB/bGR/NdH5kJmR8?v=78225c20-0424-cb9d-3fba-9216b7e617d0

Please also save the POST URL without v parameter, which will be used to send the challenge solution back to the server:

https://example.com/oh9-FCgd0/yhU7kLks/Ff0U2kh_/4s/Xz9OG03zOm9L/Hkg8dEgB/bGR/NdH5kJmR8

3. GET the script URL​

Make a GET request to the script URL to retrieve the script content.

4. Create SBSD session​

Generate the challenge solution using the Veris Labs API. You will have to provide the following parameters:

session := client.AkamaiWebSBSDSession(
    /* User agent */     "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36",
    /* Script URL */     "https://example.com/oh9-FCgd0/xyz/xyz?v=78225c20-0424-cb9d-3fba-9216b7e617d0",
    /* Script bytes */   scriptBytes,
    /* Language */       "en-US,en;q=0.9", // or a plain BCP-47 tag like "en-US"
).Create()

The language argument accepts either a plain BCP-47 tag (e.g. en-US) or the full Accept-Language header value captured from the target browser (e.g. en-US,en;q=0.9).

5. Generate first payload​

solution, _, err := session.Sensor(
    context.Background(),
    /* Page URL */       "https://example.com/product-page",
    /* Cookie (bm_so) */ "D8BF3D9435A99E335FCB7F522966F100544A9E059FD424D879DBAF63DC1AF601~YAAQcR...",
)

If you don't want to use our Go SDK, you can call the API directly, see API reference for more information.

6. POST the challenge solution​

Post the challenge solution to the same endpoint that served the script, but WITHOUT v parameter. Request contains a JSON {"body":solution}

POST /oh9-FCgd0/yhU7kLks/Ff0U2kh_/4s/Xz9OG03zOm9L/Hkg8dEgB/bGR/NdH5kJmR8 HTTP/2
content-length: 4854
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
sec-ch-ua: "Not=A?Brand";v="99", "Google Chrome";v="151", "Chromium";v="151"
content-type: application/json
sec-ch-ua-mobile: ?0
accept: */*
origin: https://example.com
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://example.com/product-page
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: ...
priority: u=1, i

{"body":"\"V~H=^\"[\"Gk(_fPzK\"J\"WO.Cv\"k\"24cH..."}

7. (Optional) Generate second payload​

solution, _, err := session.Sensor(
    context.Background(),
    /* Page URL */       "https://example.com/product-page",
    /* Cookie (bm_so) */ "D8BF3D9435A99E335FCB7F522966F100544A9E059FD424D879DBAF63DC1AF601~YAAQcR...",
)

If you don't want to use our Go SDK, you can call the API directly, see API reference for more information.

8. (Optional) POST the second payload​

Post the second payload to the same endpoint that served the script, but WITHOUT v parameter. Request contains a JSON {"body":solution}

POST /oh9-FCgd0/yhU7kLks/Ff0U2kh_/4s/Xz9OG03zOm9L/Hkg8dEgB/bGR/NdH5kJmR8 HTTP/2
content-length: 4854
sec-ch-ua-platform: "Windows"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
sec-ch-ua: "Not=A?Brand";v="99", "Google Chrome";v="151", "Chromium";v="151"
content-type: application/json
sec-ch-ua-mobile: ?0
accept: */*
origin: https://example.com
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://example.com/product-page
accept-encoding: gzip, deflate, br, zstd
accept-language: en-US,en;q=0.9
cookie: ...
priority: u=1, i

{"body":"\"V~H=^\"[\"Gk(_fPzK\"J\"WO.Cv\"k\"24cH..."}

9. Make a protected request​

Make a protected request to the target page. You should now be able to access it without being blocked by SBSD.