---
title: "FlareSolverr GET-Only Limitation and SQLite Cookie Injection"
aliases: [flaresolverr-get-only, prowlarr-cookie-injection, rutracker-bb-session]
tags: [prowlarr, flaresolverr, sqlite, homelab, torrent, indexer, rutracker]
sources:
  - "daily/2026-04-29.md"
created: 2026-04-29
updated: 2026-04-29
---

# FlareSolverr GET-Only Limitation and SQLite Cookie Injection

FlareSolverr intercepts only HTTP GET requests. Prowlarr's `DoLogin()` method sends a POST request to the indexer login endpoint — FlareSolverr cannot intercept it. This means that even when FlareSolverr is correctly tagged and running, Prowlarr's login step bypasses it entirely, causing authentication failures on indexers like RuTracker. The workaround is to inject a valid session cookie directly into Prowlarr's SQLite database.

## Key Points

- **FlareSolverr only handles GET requests** — it drives a headless browser that performs page navigation, not form POST submissions
- **Prowlarr's `DoLogin()` sends a POST** to the indexer login URL — FlareSolverr's architecture cannot intercept this
- **Even with the FlareSolverr tag correctly assigned**, Prowlarr bypasses FlareSolverr for the login step
- **Workaround: inject session cookie into Prowlarr's SQLite DB** — `IndexerDefinition` table, `Cookies` column (JSON format)
- **RuTracker `bb_session` cookie expires ~30 days** — must be refreshed from browser DevTools periodically

## Details

### Root Cause: FlareSolverr Architecture

FlareSolverr works by running a headless Chromium browser. When Prowlarr calls the FlareSolverr API with `cmd: "request.get"`, FlareSolverr navigates Chromium to that URL, solves any Cloudflare challenge, and returns the rendered page. This pipeline is fundamentally GET-only — it navigates to URLs, it does not submit forms.

Prowlarr's indexer plugins call `DoLogin()` before any search. `DoLogin()` constructs a form POST request (username, password, anti-CSRF token) and submits it to the indexer's login endpoint. FlareSolverr has no mechanism to intercept or proxy a POST submission — it is simply never in the call path for `DoLogin()`.

Result: Prowlarr successfully routes GET requests through FlareSolverr (the actual search/browse calls), but the preceding login POST always goes direct. If that direct POST is blocked by Cloudflare, authentication fails and all subsequent searches fail too.

### Workaround: SQLite Cookie Injection

Instead of logging in via Prowlarr's login flow, obtain a valid session cookie from a browser session and inject it directly into Prowlarr's database:

```bash
# 1. Stop Prowlarr to avoid DB corruption
docker compose stop prowlarr

# 2. Open the database
sqlite3 /path/to/prowlarr/config/prowlarr.db

# 3. Find the RuTracker indexer row
SELECT Id, Name, Cookies FROM IndexerDefinition WHERE Name LIKE '%RuTracker%';

# 4. Update the Cookies column with the session cookie JSON
UPDATE IndexerDefinition
  SET Cookies = '[{"name":"bb_session","value":"YOUR_BB_SESSION_VALUE","domain":".rutracker.org","path":"/"}]'
  WHERE Name LIKE '%RuTracker%';

# 5. Verify
SELECT Cookies FROM IndexerDefinition WHERE Name LIKE '%RuTracker%';

# 6. Exit and restart
.quit
docker compose start prowlarr
```

**Getting the `bb_session` cookie from the browser:**
1. Log into rutracker.org in your browser
2. Open DevTools → Application tab → Cookies → rutracker.org
3. Copy the `bb_session` cookie value
4. Paste into the SQL above

### Cookie Expiry and Refresh Process

The `bb_session` cookie expires approximately every 30 days. When searches start failing again:

1. Log into rutracker.org in a browser
2. DevTools → Application → Cookies → rutracker.org → copy new `bb_session` value
3. Stop Prowlarr, open SQLite, run the UPDATE again, restart Prowlarr

### Domain Gotcha

RuTracker has both `.nl` and `.org` domains. The `.nl` domain returns an HTTP/2 protocol error. Always use `https://rutracker.org/` as the `baseUrl` in Prowlarr indexer settings.

## Related Concepts

- [[wiki/concepts/prowlarr-flaresolverr-limitation]] — parent article: FlareSolverr plugin bug, VPN alternatives, Docker TLS fingerprint blocking
- [[wiki/concepts/sonarr-custom-format-quality-profile]] — Sonarr quality profiles; RuTracker audio verification
- [[wiki/concepts/uptime-kuma-socketio-management]] — another case of SQLite direct management for self-hosted tools
- [[wiki/homelab/_index]] — media stack: Prowlarr, Sonarr, Radarr, qBittorrent

## Sources

- [[daily/2026-04-29.md]] — FlareSolverr GET-only root cause identified; Prowlarr DoLogin() sends POST; FlareSolverr bypassed for login; bb_session cookie injection into IndexerDefinition.Cookies; 30-day expiry; .nl domain HTTP/2 error; .org is correct
