My PHP test API works in Chrome and returns JSON successfully. However, requests from Termux using curl and Python requests are blocked by a JavaScript security challenge or the connection is reset.
I am developing an Android chat app that needs to send JSON POST requests to these endpoints. Is there a supported way to use these APIs on InfinityFree hosting without the browser JavaScript challenge?
Welcome to the InfinityFree community forum! Good to have you here.
Most people answering here are volunteers. They’re often the fastest source of help. Admin (the only staff member) checks in about once a day for issues on our end.
Volunteers can’t see your account or website. Share what you actually see, like error messages and what happens when you try something. That’s more useful than your theory of what’s wrong.
AI tools often get InfinityFree wrong. If a volunteer’s advice differs from what an AI told you, please try the volunteer’s suggestion first.
Solving an issue is a joint effort. Try the suggestions you get and report back what happened.
Beep boop, I’m a bot! I dug through the forum to get you started. I sometimes get things wrong though, so do with this what you will until a human has a look.
There isn’t a supported way to do this on InfinityFree’s free hosting. The JavaScript challenge you’re seeing is a mandatory security system on all free accounts, and it can’t be turned off.
The system only lets through clients that can run JavaScript and keep a cookie, which a real browser does. Chrome passes it for that reason. Termux curl and Python requests can’t run JavaScript, so they get the challenge page instead of your JSON. The article says this applies to every URL on the site, and you can’t exempt a path, a file type, a user agent or an IP address. Using your own domain doesn’t change it either.
The article lists Android and iOS apps, REST APIs and command-line tools like cURL as things that won’t work against a free hosting account. Your PHP code never runs for those requests, so changing the scripts won’t help. If the response you get back contains aes.js, that confirms the challenge is what’s stopping the request.
The article’s suggestion for sites that need app or API access is premium hosting, which protects the site with less restrictive methods. Mobile apps, APIs and automated tools work normally there.
Here’s the article, with the full list of what is and isn’t affected: