I'm running
macOS Sequoia 15.3.2 installed using the latest
OCLP 2.2.0 on my
MacBookPro11,3 - Mid 2014.
I'm experiencing a persistent issue specifically with
Safari (version 18.3.1) on websites protected by Cloudflare that require the "Additional Verification Required" step.
The Problem:
When I encounter these Cloudflare verification pages in Safari, checking the box results in an infinite loop. The page just reloads the verification prompt again and again. This
only happens in Safari; other browsers like Chrome/Firefox work fine on the same websites.
Key Symptoms & Findings:
- Incorrect User Agent: Safari is consistently sending a User Agent string indicating macOS Catalina 10.15.7, not Sequoia. (Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Safari/605.1.15). Checked via Safari DevTools and sites like whatismybrowser.com.
- Cloudflare PAT Failure (401 Error): Using Safari's Web Inspector, the console shows a 401 Unauthorizederror when trying to fetch the Private Access Token challenge (https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/...). This seems like the likely direct cause of the loop.
- Other Console Errors:I also see related errors in Safari's console during the loop:
- Content Security Policy (CSP) errors blocking scripts (blob:https://challenges.cloudflare.com/...).
- WebGL: context lost errors.
- Sandbox read errors for cfprefsd mentioning user-preference-read or file-read-data sandbox access needed by Safari components (com.apple.SafariServices.Extens, com.apple.Safari.History) trying to access .GlobalPreferencesor com.apple.CloudKit.
Troubleshooting Steps Taken (Problem Persists):
- Updated OCLP to 2.3.0 and re-applied Build and Install and Post-Install Root Patches.
- Performed NVRAM reset.
- Tested in macOS Safe Mode: The incorrect User Agent and Cloudflare loop still occur in Safe Mode.
- Disabled ALL Safari extensions.
- Cleared all Safari cache, history, and website data repeatedly.
- Verified Safari Privacy settings (Cross-site tracking OFF, Block all cookies OFF).
- Tried Safari Private Browsing.
- Tried to reset User Agent via Safari's Develop menu (set to Automatic/Default, but still sends the wrong 10.15.7 string).
- Attempted defaults delete com.apple.Safari CustomUserAgent via Terminal, but consistently get Domain (com.apple.Safari) not found. error.
- However, defaults write com.apple.Safari TestPref value and defaults read com.apple.Safari TestPref do work, indicating the domain is partially recognized by cfprefsd.
- Confirmed com.apple.Safari.plist is NOT present in ~/Library/Preferences, but IS present and updated inside Safari's container (~/Library/Containers/com.apple.Safari/Data/Library/Preferences/).
- No VPN or Proxy active.
- Disabled/Enabled iCloud Private Relay (no change).
Hypothesis & Question:
Given that this persists in Safe Mode and involves fundamental issues like User Agent spoofing, PAT failure, and Sandbox errors, I strongly suspect this is related to OCLP's patching/spoofing interacting incorrectly with Sequoia/Safari 18.
- Is this a known issue for OCLP 2.2.0 running Sequoia on similar hardware?
- Is it known that Safari on newer macOS versions might alter its User Agent when detecting older, unsupported Model Identifiers via OCLP (even if the OS itself reports the correct version)?
- If this is the case, would the recommended fix involve changing the SystemProductName (Model Identifier) in the OpenCore config.plist to spoof a model that is officially supported by Sequoia?
- Are there any specific OCLP / OpenCore config.plist settings (e.g., related to SMBIOS SystemProductName, boot-args like amfi flags, SecureBootModel, or specific Quirks/Kexts) that are known to cause incorrect User Agent reporting or interfere with Private Access Tokens / Sandboxing in Sequoia that I could try adjusting?
Any insights or suggestions would be greatly appreciated!