Roll20 DDoS Attack

The Roll20 site went down for a brief period earlier today (August 3 - 12:48pm ET) and late last evening (August 2 - 8:16pm ET). We have confirmed that both service outages were caused by a DDoS (Distributed Denial of Service) attack. During the attack, we saw a sudden 15x increase in requests and as a result, our servers began to fail. While we have Cloudflare in place to mitigate attacks like this, the scale and speed at which this was executed meant that Cloudflare's protections were unable to sufficiently prevent loss of service.  We have implemented even more aggressive protection via Cloudflare, which we believe will prevent ongoing issues. Most systems should be operating normally, but you may see a few more "Checking your browser" interstitials than normal while navigating the site. As we continue to combat this, there may be some functionality that may not work as expected; we are working quickly to ensure those functions are restored to complete functionality ASAP.   If you're logged in and something isn’t loading correctly, try a hard refresh (Ctrl+Shift+R) to see if that resolves the issue. Please send in a Help Request Ticket if the behavior continues. Thank you for your patience as we mitigate the attack. 

Im having a problem with two API's I have been using for years now, group initiative and group check. Both lock out my API sandbox and thus cause any and all API to stop functioning requiring a restart at which point they fail again. The message given is cannot communicate with QuantumRoll server. Ive been all over searching and trying different things and cannot get the problem resolved. Its one of the weirdest things I've seen on the platform in almost 10 years and all i can think of is this has to do with the maintenance/ security/ repair you may be currently performing?

While you are at it, PLEASE do something about the whole Spammers here in the forums! Just now I flagged one commenting in the new Roll20 Reserve Thread for August 2023... And PLEASE implement a proper 2FA.

I have a problem with several API's that have worked for ages also.  As per Kyle W. says I have no idea where the error is, but it suggests its with the api servers.  I am running 4 2d20 games where i uses this code and none of them are working.  Was a nightmare last nights game with constant roll fails as all my NPCs are built in api skills....   code here: For reference, the error message generated was:  TypeError: (getRollFromInline(...) || {(intermediate value)}).getRollTip is not a function TypeError: (getRollFromInline(...) || {(intermediate value)}).getRollTip is not a function at Object.getRollTip (apiscript.js:345:68) at handleChatMessage (apiscript.js:6974:147) at eval (eval at <anonymous> (/home/node/d20-api-server/api.js:168:1), <anonymous>:65:16) at Object.publish (eval at <anonymous> (/home/node/d20-api-server/api.js:168:1), <anonymous>:70:8) at /home/node/d20-api-server/api.js:1762:12 at /home/node/d20-api-server/node_modules/firebase/lib/firebase-node.js:93:560 at hc (/home/node/d20-api-server/node_modules/firebase/lib/firebase-node.js:39:147) at Kd (/home/node/d20-api-server/node_modules/firebase/lib/firebase-node.js:93:546) at Id.Mb (/home/node/d20-api-server/node_modules/firebase/lib/firebase-node.js:93:489) at Ld.Mb (/home/node/d20-api-server/node_modules/firebase/lib/firebase-node.js:94:425)

Kyle W. said: Im having a problem with two API's I have been using for years now, group initiative and group check. Both lock out my API sandbox and thus cause any and all API to stop functioning requiring a restart at which point they fail again. The message given is cannot communicate with QuantumRoll server. Ive been all over searching and trying different things and cannot get the problem resolved. It’s one of the weirdest things I've seen on the platform in almost 10 years and all i can think of is this has to do with the maintenance/ security/ repair you may be currently performing? +1 this also happened to me. 

If you do implement a 2FA, then PLEASE do not make it mandatory. TheMarkus1204 said: While you are at it, PLEASE do something about the whole Spammers here in the forums! Just now I flagged one commenting in the new Roll20 Reserve Thread for August 2023... And PLEASE implement a proper 2FA.

We made a release that should fix mod (API) script issues; please let us know if you're still having problems!

No API functionality for Marvel games.

all back to working, good work chaps - you saved our next game

All working again, Thanks 

Why perform a DDOS attack on a gaming site? Just to be pricks? Black hat hackers suck.

Thanks for fixing this!

Is Roll20 still experiencing issues with a DDoS? I can't connect/sign in at all via the android app to view character sheets and the character sheets don't load at all when accessing from a browser on a laptop. Been having issues for the last 2 hours.

Hi Hunter,  It may be that the app has not been 'fixed' regarding the protections the Devs had to institute to deal with the DDOS. I'll let them know. 

Bianca said: We made a release that should fix mod (API) script issues; please let us know if you're still having problems Nope still broken Your scripts are currently disabled due to an error that was detected. Please make appropriate changes to your script's code and click the "Save Script" button. We will then attempt to start running the scripts again.  More info...  If this script was installed from the Mod Library, you might find help in the Community API Forum. For reference, the error message generated was:  TypeError: type.indexOf is not a function TypeError: type.indexOf is not a function at spawnFx (/home/node/d20-api-server/api.js:2996:11) at spawnFxBetweenPoints (/home/node/d20-api-server/api.js:3135:3) at doFX (apiscript.js:12018:9) at doTurnorderChange (apiscript.js:12011:9) at handleTurnorderChange (apiscript.js:11811:13) at eval (eval at <anonymous> (/home/node/d20-api-server/api.js:168:1), <anonymous>:65:16) at Object.publish (eval at <anonymous> (/home/node/d20-api-server/api.js:168:1), <anonymous>:70:8) at TrackedObj.set (/home/node/d20-api-server/api.js:1099:14) at updateLocalCache (/home/node/d20-api-server/api.js:1442:18) at /home/node/d20-api-server/api.js:1736:7 If it were just one game, I changed somthing, or I had not been using these scripts for years I would consider it a problem on my end.

Just guessing here but... could those two lines be the problem? If there's an anonymous call, that may be getting blocked by Cloudfare as part of the prevention of DDOS attacks. As I said, just a guess... Kyle W. said: at eval (eval at <anonymous> (/home/node/d20-api-server/api.js:168:1), <anonymous>:65:16) at Object.publish (eval at <anonymous> (/home/node/d20-api-server/api.js:168:1), <anonymous>:70:8)

I still can't log on with Chrome with my tablet, but have no problem with my desktop. Same browser, different platform. I'm also blaming it on the %$#&@ criminals that launched the DDOS attack. I only use the tablet for reading this forum though, so it's just an inconvenience for me. Still annoying though. Hunter S. said: Is Roll20 still experiencing issues with a DDoS? I can't connect/sign in at all via the android app to view character sheets and the character sheets don't load at all when accessing from a browser on a laptop. Been having issues for the last 2 hours. Gauss said: Hi Hunter,  It may be that the app has not been 'fixed' regarding the protections the Devs had to institute to deal with the DDOS. I'll let them know. 

Nope nothing is working, I know this DDoS attack is out of your control, but the platform is really showing its age, even before this my games are laggy, have connectivity issues and crash, music doesn't work properly, LFG is a pay to play circus, and now the API that is a huge quality of life improvement for DM's is bricked. Dynamic lighting improvements as of late have been very nice to have, however at this point the platform consistently falls short at running the size and scope of games I enjoy playing and DM'ing. I've been in touch through email and received the standard response "We have implemented fixes that should restore functionality to the API system" multiple times now...with my billing cycle approaching, I cannot in good conscience continue to pay for this service as it is. 

As of the last couple hours, having NO luck uploading images in any way. Everything times out.

I'm not going to say that the whole "thing" is an inside job but... In B4 they increases the prices of Subscriptions once they "fix" this

The Charactermancer stopped working in all of our games. PDFs cannot be uploaded. Pictures, texts and exports work again though.

Christian D. said: The Charactermancer stopped working in all of our games. PDFs cannot be uploaded. Pictures, texts and exports work again though. Hi Christian, does the compendium still work in your games?  If not that may be the reason for the Charactermancer not working.  You might try turning off the Compendium, saving, then turning it back on (and saving again).  Then refresh your game.

If it helps anyone here, I get stuck without images loading and my in-game search not working, etc, too, but I have a workaround. I have to open roll20.net in another tab, let it confirm my security, and then refresh my main screen and everything works gain. Unfortunately, I have to do this several times a session, and that means re-opening every sheet and handout (a pain for a DM).

I had a strange A/V disconnect on tonight’s game I was running. I’d see loss of sync between audio and video. Audio was clear but the video sped up and slowed down. Connectivity was good and no one was booted. The players didn’t experience it - only the GM. Any thoughts?

Hello Gauss The compendiums wasn't working either but I tried your suggested solution and now both the compendium searches and the charactermancer is working again. My group is now back on track and ready for their next adventure! :) Gauss said: Christian D. said: The Charactermancer stopped working in all of our games. PDFs cannot be uploaded. Pictures, texts and exports work again though. Hi Christian, does the compendium still work in your games?  If not that may be the reason for the Charactermancer not working.  You might try turning off the Compendium, saving, then turning it back on (and saving again).  Then refresh your game.

I was wondering why i was gettin login checks!  Thanks for sorting this out for us.

Since last week's D&D game, my players and I have struggled to get character sheets to load quickly. When the sheet is opened, it's completely blank white and freezes any clickable actions you would take for a solid minute. Please help! 

have had huge problems this evening with freezes, crashes etc even tinting the map screen caused some of my players browsers to crash. Roll20 has not been right since the DDoS attack.

Hey folks! I'm going to close this thread; if you're still seeing strange behavior in your games, please fill out a Help Request and we can take a look. Thank you!