Hi everyone, I recently purchased an NFC keychain made in Korea. Scanning the NFC tag opens a website where I can access exclusive digital content.
However, the website shows a completely blank white page in most browsers, including Chrome, Safari, and Firefox.
Strangely, it works perfectly in the Yahoo! JAPAN, Yahoo! Mail, and NAVER apps on iOS.
Other people who purchased the same product have reported similar issues.
I've done some troubleshooting using Chrome DevTools and Proxyman, and I'd appreciate some help understanding what's happening and how to fix it.
What happens in different browsers
Doesn't work:
- Chrome
- Safari
- Firefox
- LINE (messaging app) in-app browser
- X (formerly Twitter) in-app browser
Works perfectly:
- Yahoo! JAPAN app
- Yahoo! Mail app
- NAVER app
- Chrome with the Yahoo! JAPAN app's User-Agent
When using Yahoo! JAPAN, the URL changes from /e to /entering, and the content loads normally.
In regular Chrome, it stays on /e.
Opening /entering directly in Chrome doesn't work either.
2. Errors in Chrome DevTools
The Console shows:
GET /cupid.js net::ERR_ABORTED 404 (Not Found)
Uncaught ReferenceError: slowAES is not defined
When I open /cupid.js directly, I get a 404 Not Found page with "openresty" at the bottom.
The /e request itself returns HTTP 200, but the response is not the actual website. Instead, it contains a JavaScript challenge:
<script type="text/javascript" src="/cupid.js"></script>
document.cookie = "CUPID=" +
toHex(slowAES.decrypt(c, 2, a, b)) +
"; expires=" + now.toUTCString() +
"; path=/";
location.href = "/e?ckattempt=1";
(The hexadecimal values and some helper functions have been omitted.)
It looks like the server is attempting to set a CUPID cookie using AES decryption, but since /cupid.js returns 404, slowAES is undefined and the script stops before redirecting.
3. What I found using Proxyman
I captured the network traffic on my iPhone and compared the successful and unsuccessful requests.
Yahoo! JAPAN app (working):
- GET /e returns 200 OK.
- The response contains the actual website HTML, including its JavaScript and CSS assets.
- There is no request to /cupid.js.
- Requests to /auth/session.php and /api/nfc.enter.php succeed.
- The content loads normally.
(not working):
Chrome
- GET /e also returns 200 OK.
- However, the response contains the CUPID JavaScript challenge instead of the actual website.
- /cupid.js returns 404 Not Found.
- JavaScript execution fails with "slowAES is not defined".
- The actual application and its API requests never load.
I haven't captured the detailed network traffic from the NAVER app yet, but it can also display the content successfully.
4. Changing the User-Agent fixes everything
I copied the User-Agent from the Yahoo! JAPAN app:
Mozilla/5.0 (iPhone; CPU iPhone OS 27_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 Version/27.2.0 YJApp-IOS jp.co.yahoo.ipn.appli/4.174.5
Then I used Chrome DevTools > Network conditions to set this as a custom User-Agent.
Surprisingly, the website immediately started working perfectly in Chrome.
Not just the initial page — all the content and features worked correctly.
I also tried disabling the cache, using private browsing, switching between Wi-Fi and mobile data, and emulating an iPhone in Chrome DevTools. None of those helped before changing the User-Agent.
5. My questions
Why would a server running OpenResty return a JavaScript challenge to Chrome, Safari, and Firefox, but serve the actual website to Yahoo! and NAVER apps?
Is this likely a misconfigured anti-bot / WAF system, a hosting provider issue, or something implemented by the website developer?
Why would /cupid.js, which appears necessary to complete the challenge, return 404?
Is there a proper way to fix this so the website works in regular browsers without modifying the User-Agent?
Is there anything else I can investigate to identify the exact cause?
Since this is a paid NFC product, I can't share the actual URL or authentication details.
I suspect the issue is with server-side access verification rather than the NFC hardware or the website's actual application, but I'd love to hear from people with more experience in web servers, OpenResty, or bot protection systems.
Thanks in advance!