Cómo solucionar el error “Enable JavaScript and cookies to continue”

This guide explains how to resolve the error message that states "Enable JavaScript and cookies to continue" when accessing a website protected by Cloudflare or a similar security proxy. The issue occurs when the client fails to meet minimum security requirements, such as disabling JavaScript or disabling/expiring cookies.

The technical cause behind this security mechanism is Cloudflare's implementation of a JavaScript Challenge, which requires the browser to execute a script to prove it's not a bot. Following a successful challenge, Cloudflare issues a verification cookie (__cf_bm or cf_clearance) to validate the session. If the client (browser or custom HTTP client) doesn't execute JavaScript or improperly handles cookies, the validation will fail and the error message will be displayed.

To fix the issue for end users, it's necessary to enable JavaScript in their web browser. For Google Chrome, this can be done through the Privacy and Security settings, while in Mozilla Firefox, it's managed in the Privacy and Security preferences under Permissions. Additionally, enabling third-party cookies (if using extensions like uBlock Origin or Privacy Badger) can help, temporarily disabling ad-blockers and clearing cookies and cache for the affected domain can also work, and restarting the browser after making these changes is recommended.

For developers and automation engineers, using a headless browser with JavaScript and cookie support is the recommended approach. An example using Playwright is provided, which involves launching a Chromium browser in headless mode, creating a new context, navigating to the desired URL, and verifying that the JavaScript challenge has been successfully completed. The response can then be scraped for further processing.

Alternatively, simulating the challenge manually is possible, but it's not recommended as it's only viable if the site doesn't utilize Cloudflare or other bot management systems. This method requires analyzing the challenge script, solving it (for example, using cloudscraper), and maintaining cookies. However, this approach is not foolproof as Cloudflare frequently updates its challenges and cloudscraper may become obsolete within a few weeks.

If you control the server, you can configure Cloudflare to use the "I'm Under Attack" mode only for sensitive endpoints, or utilize Cloudflare Turnstile, a more modern and accessible replacement for challenge-based security. For local testing, it's advised to temporarily disable Cloudflare (development mode) or add your IP address to the whitelist. Ultimately, the most reliable solution is to ensure JavaScript is enabled and cookie management is properly implemented in the environment accessing the site.