DIYgod/RSSHub · error · Error

Baidu security verification required. The cookie may be expi

Error message

Baidu security verification required. The cookie may be expired or invalid. Please update your BAIDU_COOKIE.

What it means

Thrown by checkSecurityVerification in the Baidu Tieba common helpers after a fetched page's HTML is detected as a Baidu security-verification (anti-bot) wall. The check matches the substrings '安全验证' or '百度安全验证', which appear when BAIDU_COOKIE is expired, invalid, or absent, signalling the request was challenged rather than served real content.

Source

Thrown at lib/routes/baidu/tieba/common.ts:33

export function parseBaiduCookies(cookieStr: string): Array<{ name: string; value: string; domain: string; path: string }> {
    return cookieStr
        .split(';')
        .map((c) => Cookie.parse(c.trim()))
        .filter((c): c is Cookie => Boolean(c?.key))
        .map((c) => ({
            name: c.key,
            value: c.value,
            domain: '.tieba.baidu.com',
            path: '/',
        }));
}

/**
 * 检查 HTML 内容是否包含百度安全验证页面
 */
export function checkSecurityVerification(html: string): void {
    if (html.includes('安全验证') || html.includes('百度安全验证')) {
        throw new Error('Baidu security verification required. The cookie may be expired or invalid. Please update your BAIDU_COOKIE.');
    }
}

/**
 * 使用 Playwright 获取贴吧页面内容
 * 包含统一的 cookie 设置、安全验证检查和缓存逻辑
 * 带有重试机制处理瞬态错误
 */
export async function getTiebaPageContent(
    url: string,
    cacheKey: string,
    options: {
        waitForSelector?: string;
        timeout?: number;
        retries?: number;
    } = {}
): Promise<string> {
    const cookie = config.baidu.cookie;

View on GitHub (pinned to bed535e087)

Solutions

Refresh BAIDU_COOKIE by logging into tieba.baidu.com in a browser and copying a fresh cookie string (must include BDUSS) into the BAIDU_COOKIE env var.
Ensure the cookie's domain scope covers .tieba.baidu.com and that you are not being challenged due to IP reputation (try a residential egress).
If using Playwright, confirm waitForSelector is finding real thread content rather than the verification page; consider raising retries or adding a cookie-rotation strategy.

Defensive patterns

Strategy: try-catch

Validate before calling

function looksLikeSecurityWall(html: string): boolean {
    return html.includes('安全验证') || html.includes('百度安全验证');
}
// before fetching heavily, peek the page; if true, refresh cookie first

Try / catch

try {
    return await getTiebaPageContent(url, cacheKey, { retries: 3 });
} catch (e) {
    if (e instanceof Error && /security verification|BAIDU_COOKIE/i.test(e.message)) {
        // refresh BAIDU_COOKIE out-of-band, then retry once
    }
    throw e;
}

Prevention

Keep BAIDU_COOKIE fresh; rotate before it expires rather than after.
Monitor for the verification substrings and alert so expiry is detected proactively.
Run from a stable egress IP to reduce anti-bot triggers.

When it happens

Trigger: getTiebaPageContent (or any caller of checkSecurityVerification) fetches a Tieba page and the returned HTML contains the security-verification markers, typically after Playwright loaded the page with an expired/invalid BAIDU_COOKIE.

Common situations: BAIDU_COOKIE expired since last refresh; cookie set but not for the .tieba.baidu.com domain; Baidu tightened its anti-bot heuristics; running from a datacenter IP that Baidu flags.

Related errors

AI-assisted analysis of DIYgod/RSSHub@bed535e087 (2026-08-12). Data as JSON: /api/errors/97101ce76c0026f0. Report an issue: GitHub.