Managed Challenge 500 Error for POST Requests with sid Query Parameter — Login & Register Pages Neve
Hello Cloudflare Support,
Since around a few day ago, POST requests to our phpBB login and registration pages fail with a 500 Internal Server Error generated by Cloudflare’s edge after passing the Managed Challenge.
Key facts:
This was working previously with no changes to our origin or application.
The 500 error is coming directly from Cloudflare’s edge (not our origin).
Requests never reach our origin server — no entries in Apache/nginx or PHP logs.
The issue occurs only after Managed Challenge on POST requests with form data that include a sid session ID in the query string; requests without sid work fine.
Example affected URLs:
https://www.wagnardsoft.com/forums/ucp.php?mode=login&sid=...
https://www.wagnardsoft.com/forums/ucp.php?mode=register&sid=...
Example Ray ID: 96bf31addb65a204-YYZ (register page)
Request method: POST, content-type: application/x-www-form-urlencoded.
After challenge is solved, Cloudflare fails to replay the POST to the origin and responds with a 500.
Note accessing without the &sid=.... work
disabling the managed challenge for theses page also work.
Steps to Reproduce:
Visit https://www.wagnardsoft.com/forums/ucp.php?mode=register&sid=... or ...mode=login&sid=...
Pass the Managed Challenge. (usually automatic)
Check origin logs — no request is received.
Impact:
Users cannot log in or register if they are presented with a Managed Challenge and the URL contains a sid parameter, blocking forum access for affected visitors.
Since around a few day ago, POST requests to our phpBB login and registration pages fail with a 500 Internal Server Error generated by Cloudflare’s edge after passing the Managed Challenge.
Key facts:
This was working previously with no changes to our origin or application.
The 500 error is coming directly from Cloudflare’s edge (not our origin).
Requests never reach our origin server — no entries in Apache/nginx or PHP logs.
The issue occurs only after Managed Challenge on POST requests with form data that include a sid session ID in the query string; requests without sid work fine.
Example affected URLs:
https://www.wagnardsoft.com/forums/ucp.php?mode=login&sid=...
https://www.wagnardsoft.com/forums/ucp.php?mode=register&sid=...
Example Ray ID: 96bf31addb65a204-YYZ (register page)
Request method: POST, content-type: application/x-www-form-urlencoded.
After challenge is solved, Cloudflare fails to replay the POST to the origin and responds with a 500.
Note accessing without the &sid=.... work
disabling the managed challenge for theses page also work.
Steps to Reproduce:
Visit https://www.wagnardsoft.com/forums/ucp.php?mode=register&sid=... or ...mode=login&sid=...
Pass the Managed Challenge. (usually automatic)
Check origin logs — no request is received.
Impact:
Users cannot log in or register if they are presented with a Managed Challenge and the URL contains a sid parameter, blocking forum access for affected visitors.
