What causes "acw_sc__v2 validation error" in AlistGo/alist?

Slow down: add spacing between lanzou requests / reduce concurrency — many challenges are purely rate-based

acw_sc__v2 validation error

Error message

acw_sc__v2 validation error

What it means

The lanzou web endpoint serves an anti-bot JS challenge (acw_sc__v2); the driver detects it with findAcwScV2Reg, computes the cookie via CalcAcwScV2, and retries in a loop. This error means the loop exhausted (3 iterations) while the body still matches the challenge, or the challenge page could not be parsed (arg1 missing/malformed). It is an anti-crawl defeat, not a config error.

Source

Thrown at drivers/lanzou/util.go:146

		res, err := req.Execute(method, url)
		if err != nil {
			return nil, err
		}
		body = res.Body()
		log.Debugf("lanzou request: url=>%s ,stats=>%d ,body => %s\n", res.Request.URL, res.StatusCode(), res.String())

		if findAcwScV2Reg.Match(body) {
			vs, e := CalcAcwScV2(string(body))
			if e != nil {
				log.Errorf("lanzou: err => acw_sc__v2 validation error  ,data => %s\n", body)
				return body, e
			}
			acwScV2 = vs
			continue
		}
		return body, nil
	}
	return body, errors.New("acw_sc__v2 validation error")
}

var loginURL = "https://up.woozooo.com/mlogin.php"

func (d *LanZou) Login() ([]*http.Cookie, error) {
	client := base.NewRestyClient().SetRedirectPolicy(resty.NoRedirectPolicy())
	// 登录接口同样可能返回 acw_sc__v2 反爬挑战页,需算出 cookie 后重试
	var acwScV2 string
	var resp *resty.Response
	var err error
	for i := 0; i < 3; i++ {
		req := client.R().SetFormData(map[string]string{
			"task":         "3",
			"uid":          d.Account,
			"pwd":          d.Password,
			"setSessionId": "",
			"setSig":       "",
			"setScene":     "",

View on GitHub (pinned to 843d9dc814)

Solutions

Slow down: add spacing between lanzou requests / reduce concurrency — many challenges are purely rate-based
Route requests through a residential proxy or run the alist instance from a different IP
Update alist — a driver fix for a new acw_sc__v2 variant usually follows within days of lanzou changing it
Verify cookies (ylogin etc.) are valid: log in again so challenge pages are less aggressive

Defensive patterns

Strategy: retry

Type guard

func isAcwScV2Failure(err error) bool {
	return err != nil && strings.Contains(err.Error(), "acw_sc__v2")
}

Try / catch

var body []byte
err := backoff.Retry(func() error {
	var e error
	body, e = d.get(url, nil)
	if e != nil && isAcwScV2Failure(e) {
		return e // retryable: challenge is often rate-based
	}
	return backoff.Permanent(e)
}, backoff.WithMaxRetries(backoff.NewExponentialBackOff(), 3))

Prevention

Rate-limit lanzou scraping aggressively; the challenge is triggered by request velocity
Keep alist updated — acw_sc__v2 algorithm fixes land quickly after lanzou rotates obfuscation
Prefer account cookies (ylogin) over anonymous scraping to reduce challenge frequency

When it happens

Trigger: Every retry response still contains the acw_sc__v2 challenge HTML — e.g. CalcAcwScV2 keeps failing on the page's arg1 value (obfuscation changed), or the site returns the challenge unconditionally to this IP (rate-limited/datacenter IP flagged).

Common situations: Lanzou rotated its JS obfuscation so the Go port of the acw_sc__v2 algorithm no longer computes the right cookie; alist server IP flagged by anti-bot; hammering the share pages too fast.

Related errors

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/bdcfbfa6ea71f6ce. Report an issue: GitHub.