ESP32 receives JavaScript security challenge instead of JSON from PHP API

[krish_1611]

Website URL

https://smart-parking.freehosting.dev/

Error Message

Hello InfinityFree Community,

I am building a Smart Parking System using an ESP32, and my website is hosted on InfinityFree.

Website: https://smart-parking.freehosting.dev/

API endpoint: https://smart-parking.freehosting.dev/esp32_api.php

When I open the API URL in my browser, it returns JSON:

{“success”:false,“message”:“Unauthorized”}

However, when my ESP32 sends an HTTP POST request with a JSON body and an X-API-Key header, the response is HTTP 200 containing an HTML page with /aes.js and JavaScript that attempts to set a __test cookie.

My ESP32 cannot execute this JavaScript, so it cannot receive the JSON response required for my project.

I would like to keep my website and database on InfinityFree.

Could someone explain whether direct ESP32 requests to PHP API endpoints are supported on free hosting, and what supported solution I can use?

Thank you.

Other Information

I am using an ESP32 board with Arduino IDE for my Smart Parking System. My website uses PHP and MySQL and is hosted on InfinityFree.

The API works in my laptop browser and returns JSON, but requests from the ESP32 receive HTTP 200 with an HTML JavaScript security challenge containing /aes.js instead of JSON.

My ESP32 sends a JSON POST request with an X-API-Key header. I want to keep my existing InfinityFree website and database.

I have not confirmed whether the security challenge can be resolved on my current hosting plan. I would appreciate guidance on supported solutions for ESP32-to-PHP API communication.

[system]

Welcome to the InfinityFree community forum! Good to have you here.

• Most people answering here are volunteers. They’re often the fastest source of help. Admin (the only staff member) checks in about once a day for issues on our end.
• Volunteers can’t see your account or website. Share what you actually see, like error messages and what happens when you try something. That’s more useful than your theory of what’s wrong.
• AI tools often get InfinityFree wrong. If a volunteer’s advice differs from what an AI told you, please try the volunteer’s suggestion first.
• Solving an issue is a joint effort. Try the suggestions you get and report back what happened.

[Lemni]

Beep boop, I’m a bot! I dug through the forum to get you started. I sometimes get things wrong though, so do with this what you will until a human has a look.

Direct requests from an ESP32 to a PHP endpoint on free hosting aren’t supported. What you’re seeing is the expected behaviour, and it can’t be turned off.

Every free InfinityFree account sits behind a browser security system. It only lets a request through if the client can run JavaScript and keep a cookie. That’s the /aes.js page setting a __test cookie. Your laptop browser passes the check, so you get your JSON. An ESP32 can’t run the JavaScript, so it gets the challenge page. The article lists REST APIs and automated scripts among the things that don’t work:

Browser Security System - Features and Limitations

InfinityFree uses a security system on all free hosting accounts to ensure your website is accessed by real web browsers, not bots or automated scripts. While this protects your site from malicious traffic, it can affect certain types of access. How the security system works The system checks that visitors can execute JavaScript and accept cookies: features that all modern web browsers support. This verification happens automatically and most website visitors will never notice it. You may occa…

The article says the system is mandatory on free hosting. It also says premium hosting uses less restrictive protection, so APIs work normally there. Its options for API access are:

• Move the API to premium hosting.
• Host the API on a service built for that.
• Have your site make outbound requests instead. Outbound calls from your PHP code to other servers aren’t affected.

Here’s the article on API access:

Why isn't API access working on my website?

If you’re trying to use APIs on your InfinityFree website and they’re not working, this is due to our browser security system that’s required on all free hosting accounts. What’s happening? InfinityFree uses a security system that requires JavaScript and cookies to access websites. APIs and automated tools typically can’t execute JavaScript or store cookies, so they get blocked by the security system. When API clients try to connect, they usually receive a “403 Forbidden” error or a HTML respo…

I didn’t find a documented way to get an ESP32 past the challenge on a free account. If you want to keep the site and database on InfinityFree, the outbound route is the one that fits. The ESP32 would need to send its data to something that isn’t behind this check, and your site would then pull from it.

[dan3008]

InfinityFree is designed for hosting websites to be accessed by humans using a browser.

Its not intended for hosting API’s or automated systems. This is made clear in the T&C’s you agreed to when signing up.

The security system is designed to stop non-browser based requests, such as from your ESP device.

There is no way around this I’m afraid.