---
title: "Known problems"
manual: "SOLR_SHIELD"
version: "1.0"
permalink: "https://docs.typo3.org/permalink/maikschneider/solr-shield:known-problems@1.0"
source: "KnownProblems/Index.rst"
rendered: "2026-10-23T16:05:45+00:00"
---

# Known problems {#known-problems}

-   **The token does not cover the payload**

    The token in `_ss` is the same for every link and appears on every
    search page, so a client that reads one page can build `_ss` values
    for any parameter combination. Solr Shield stops crawlers that follow or
    mutate `tx_solr` links, not a bot written against it
    ([#6](https://github.com/maikschneider/solr-shield/issues/6)).

-   **Bot detection excludes visitors without JavaScript**

    With [solrShield.botDetection.enabled](https://docs.typo3.org/permalink/maikschneider/solr-shield:confval-setting-botdetection-enabled@1.0), a search without the
    behavioural payload is rejected. That includes visitors who block
    JavaScript.

-   **Custom range facet scripts are not patched**

    Only EXT:solr's own `facet_daterange_controller.js` and
    `facet_numericrange_controller.js` are swapped for the patched copies
    (see [Range facets](https://docs.typo3.org/permalink/maikschneider/solr-shield:how-it-works-range-facets@1.0)). Range filters in your own,
    modified or bundled copies break with URI obfuscation until you port the
    changes (see [Copied or bundled EXT:solr scripts](https://docs.typo3.org/permalink/maikschneider/solr-shield:integration-copied-scripts@1.0)).

-   **Bot detection payloads can be replayed**

    The payload is generated in the browser and is not signed. A bot that
    records one from a real browser can send it again for up to ten minutes,
    or fake one altogether. Bot detection raises the cost of scripted
    crawling; it does not prove a human is present.