<div style="font-family: Arial, sans-serif; padding: 15px;

Q: What causes " 🔒 本次登录需要验证 This login requires verification 下面是验证所需要的数据，具体使用方法请参照对应的驱动文档 Below are the relevant verification data. For specific usage methods, please refer to the corresponding driver documentation. %s " in AlistGo/alist?

Read the JSON block inside the HTML error and follow the Thunder driver doc: use the creditkey/reviewurl/deviceid to complete verification (e.g. via the verification page or thunder-jwt flow), then re-login.

Error message

<div style="font-family: Arial, sans-serif; padding: 15px; border-radius: 5px; border: 1px solid #e0e0e0;>
    <h3 style="color: #d9534f; margin-top: 0;">
        <span style="font-size: 16px;">🔒 本次登录需要验证</span><br>
        <span style="font-size: 14px; font-weight: normal; color: #666;">This login requires verification</span>
    </h3>
    <p style="font-size: 14px; margin-bottom: 15px;">下面是验证所需要的数据，具体使用方法请参照对应的驱动文档<br>
    <span style="color: #666; font-size: 13px;">Below are the relevant verification data. For specific usage methods, please refer to the corresponding driver documentation.</span></p>
    <div style="border: 1px solid #ddd; border-radius: 4px; padding: 10px; overflow-x: auto; font-family: 'Courier New', monospace; font-size: 13px;">
        <pre style="margin: 0; white-space: pre-wrap;"><code>%s</code></pre>
    </div>
</div>

What it means

Thrown by the Thunder (Xunlei) driver when the API responds with error code/error message 'review_panel', meaning the account login was flagged and requires SMS/device verification. The driver collects ReviewData (credit key, review URL with deviceid, device sign) into JSON and embeds it in an HTML-styled error so the user can complete verification using the thunder-jwt or verification tools described in the driver docs. It is not a bug: it is a controlled credential-verification flow surfaced through fmt.Errorf.

Source

Thrown at drivers/thunder/util.go:228

	if err := utils.Json.Unmarshal(res.Body(), &reviewResp); err != nil {
		return err
	}

	deviceSign := generateDeviceSign(c.DeviceID, c.PackageName)

	reviewData = ReviewData{
		Creditkey:  reviewResp.Creditkey,
		Reviewurl:  reviewResp.Reviewurl + "&deviceid=" + deviceSign,
		Deviceid:   deviceSign,
		Devicesign: deviceSign,
	}

	// 将reviewData转为JSON字符串
	reviewDataJSON, _ := json.MarshalIndent(reviewData, "", "  ")
	//reviewDataJSON, _ := json.Marshal(reviewData)

	return fmt.Errorf(`
<div style="font-family: Arial, sans-serif; padding: 15px; border-radius: 5px; border: 1px solid #e0e0e0;>
    <h3 style="color: #d9534f; margin-top: 0;">
        <span style="font-size: 16px;">🔒 本次登录需要验证</span><br>
        <span style="font-size: 14px; font-weight: normal; color: #666;">This login requires verification</span>
    </h3>
    <p style="font-size: 14px; margin-bottom: 15px;">下面是验证所需要的数据，具体使用方法请参照对应的驱动文档<br>
    <span style="color: #666; font-size: 13px;">Below are the relevant verification data. For specific usage methods, please refer to the corresponding driver documentation.</span></p>
    <div style="border: 1px solid #ddd; border-radius: 4px; padding: 10px; overflow-x: auto; font-family: 'Courier New', monospace; font-size: 13px;">
        <pre style="margin: 0; white-space: pre-wrap;"><code>%s</code></pre>
    </div>
</div>`, string(reviewDataJSON))
}

// 计算文件Gcid
func getGcid(r io.Reader, size int64) (string, error) {
	calcBlockSize := func(j int64) int64 {
		var psize int64 = 0x40000
		for float64(j)/float64(psize) > 0x200 && psize < 0x200000 {

View on GitHub (pinned to 843d9dc814)

Solutions

Read the JSON block inside the HTML error and follow the Thunder driver doc: use the creditkey/reviewurl/deviceid to complete verification (e.g. via the verification page or thunder-jwt flow), then re-login.
Complete the review URL (it already contains deviceid) in a browser where you are logged into the same Thunder account, approve the SMS/device check, then retry the mount.
Rotate the login: refresh token / re-run login so a new JWT with fresh device sign is issued, and avoid triggering risk control (shared IPs, rapid restarts).
If it recurs persistently, treat it as account-level risk control: change password or verify the account on the official Xunlei client first.

Defensive patterns

Strategy: try-catch

Try / catch

if err := driver.Request(...); err != nil {
    if strings.Contains(err.Error(), "本次登录需要验证") || strings.Contains(err.Error(), "review_panel") {
        // parse embedded JSON, guide user through verification flow
        log.Warn("thunder verification required: complete review flow, then re-login")
    }
    return err
}

Prevention

Persist a stable DeviceID in the storage config to reduce risk-control triggers
Avoid frequent re-logins or IP changes for Thunder accounts
Complete SMS/device verification once via the review URL before automating

When it happens

Trigger: Any Thunder API request executed through Common.Request whose response body unmarshals to ErrResp with ErrorMsg == "review_panel"; getReviewData is then called and returns this HTML error containing the marshaled ReviewData (creditkey, reviewurl + deviceid, devicesign).

Common situations: Logging into Thunder from a new IP or datacenter, long-lived tokens expiring their trust, frequent re-logins, or account risk control. Common after changing machines or when using the account without completing SMS verification once.

Related errors

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/3e62fb5d1971eee4. Report an issue: GitHub.