> For the complete documentation index, see [llms.txt](https://docs.disasm.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.disasm.dev/incapsula/utmvc.md).

# utmvc

The utmvc challenge is a legacy challenge and is often no longer required, but some sites do still use it.

## How do I know if I need to solve UTMVC?

If you try to access a protected site, the server may return this block page:

```html
<html>
<head>
<META NAME="robots" CONTENT="noindex,nofollow">
<script src="/_Incapsula_Resource?SWJIYLWA=5074a744e2e3d891814e9a2dace20bd4,719d34d31c8e3a6e6fffd425f7e032f3">
</script>
<body>
</body></html>
```

If you see this, you usually need to solve UTMVC.

## How do I solve the challenge?

1. Perform a GET request to the script `src` in the block page.
   * Here it is `/_Incapsula_Resource?SWJIYLWA=5074a744e2e3d891814e9a2dace20bd4,719d34d31c8e3a6e6fffd425f7e032f3`, but it will be different for you, so parse it from the page.
2. The GET returns an obfuscated JavaScript challenge script. Base64-encode the response and send it as the `script` parameter to our API (see the [API Reference](/incapsula/api-reference.md)).
3. The API returns a JSON object with two values: `___utmvc` and `SWHANEDL`.
4. If `SWHANEDL` has a value, make a GET request to `/_Incapsula_Resource?SWHANEDL=` followed by the value returned from the API.
5. Add the `___utmvc` cookie to your requests.
6. Perform a GET request to `/_Incapsula_Resource?SWKMTFSR=1&e=0.47671500400673494`. Replace `0.47671500400673494` with a random value below 1 with 15 decimal places - in JavaScript, `Math.random()` does this.
7. If the `___utmvc` cookie was accepted, the response body contains `1`.
8. Retry the original blocked request; it should now succeed. The screenshot below shows an example of the request sequence.

<figure><img src="https://247206371-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9SOK2vRfVrff5bXffY0t%2Fuploads%2FEBCCS6w0suXhLHbKREFI%2Fimage.png?alt=media&amp;token=babe08f9-0829-4870-a469-53ff00b63f64" alt=""><figcaption></figcaption></figure>