Old version
May 9, 2026 02:00 UTC
68439346f006689d09c05209a03e13618c70fc2aac361f8459bd5abf6924fe0f
CA-V-002350
New version
May 11, 2026 15:23 UTC
bbdf1435dcb4ce3efaf2a31c442bf575c3927bfbba472d4d9db867dd059c32b8
CA-V-002417
Share 𝕏 Share in Share
Change Summary
The detected change consists of updates to nonce values and timestamps in the HTML security infrastructure of Booking.com's challenge page, not substantive modifications to the Terms and Conditions themselves. The security tokens and JavaScript nonce identifiers were refreshed, and a timestamp parameter in the challenge authentication process was updated. This represents a technical maintenance update to the security layer serving the terms page, not a change to the terms content or user obligations.
low severity
0 Sentences added
0 Sentences removed
1 Sentences modified
3 Sentences before
3 Sentences after
Added
Removed
Modified
BeforeAfter
0<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <title></title> <style> body { font-family: "Arial"; } </style> <script type="text/javascript" nonce="17782920174890.7381180260009492"> function getAjaxObject() { var ajax; if (window.XMLHttpRequest) { try { ajax = new window.XMLHttpRequest(); // XMLHttpRequest (Mozilla, Opera, Safari, etc.) } catch (e) { return false; } } else { var msXML = new Array( // XMLHttpRequest (IE with ActiveX) "Msxml2.XMLHTTP.5.0", "Msxml2.XMLHTTP.4.0", "Msxml2.XMLHTTP.3.0", "Msxml2.XMLHTTP", "Microsoft.XMLHTTP" ); for (var i = 0; i < msXML.length; i++) { // We want to get the best we can try { ajax = new ActiveXObject(msXML[i]); break; } catch (e) { return false; } } } return ajax; } function sendAjaxRequest(url, data, callback) { const xhr = getAjaxObject(); if (!xhr) { callback(new Error('Unable to create XMLHttpRequest object'), null); return; } xhr.open('POST', url, true); xhr.setRequestHeader('Content-Type', 'application/json'); xhr.setRequestHeader('Accept', 'application/json'); xhr.onreadystatechange = function() { if (xhr.readyState === 4) { if (xhr.status >= 200 && xhr.status < 300) { try { const response = JSON.parse(xhr.responseText); callback(null, response); } catch (error) { callback(error, null); } } else { callback(new Error('HTTP error! status: ' + xhr.status), null); } } }; xhr.onerror = function() { callback(new Error('Network error'), null); }; xhr.send(JSON.stringify(data)); } function reportChallengeError(log, challengeError) { try { sendAjaxRequest( 'https://reports.booking.com/chal_report', { log: log, message: challengeError.message, stack: challengeError.stack }, (e, response) => { if (e) { console.error('Request failed:', e); } else { console.log('Success:', response); } } ); } catch (e) {} } function setupErrorHandling() { // Handle JavaScript errors window.addEventListener('error', function(event) { var error = { message: event.message, stack: event.error ? event.error.stack : '' }; reportChallengeError('javascript_error', error); }); // Handle unhandled promise rejections window.addEventListener('unhandledrejection', function(event) { var error = { message: event.reason && event.reason.message ? event.reason.message : 'Unhandled Promise Rejection', stack: event.reason && event.reason.stack ? event.reason.stack : '' }; reportChallengeError('promise_rejection', error); }); } // Initialize error handling setupErrorHandling(); </script> <script type="text/javascript" nonce="17782920174890.7381180260009492"> window.awsWafCookieDomainList = ['booking.com']; </script> <script type="text/javascript" src="https://www.booking.com/__challenge_h78IRKX3kpQxScCExxShBNwRUlb/d8c14d4960ca/a18a4859af9c/challenge.js" nonce="17782920174890.7381180260009492"></script> <script type="text/javascript" nonce="17782920174890.7381180260009492"> const maxLocationLength = 2047 - "&chal_t=1760623098515&force_referer=".length; function searchStringWithNewParam(search, key, value) { value = encodeURIComponent(value); if (!search.startsWith('?')) { return search + `?${key}=${value}`; } else if (search.endsWith('&')) { return search + `${key}=${value}`; } else { return search + `&${key}=${value}`; } } function getNewUrlWithAddedParameter(location, parameters) { let newSearch = location.search; for (let parameterName of Object.keys(parameters)) { if (!newSearch.includes(`${parameterName}=`)) { newSearch = searchStringWithNewParam(newSearch, parameterName, parameters[parameterName]); } } let newHref = `${location.pathname}${newSearch}${location.hash}`; if (newHref.length < maxLocationLength) { return newHref; } return null; } </script> </head> <body> <div id="challenge-container"></div> <script type="text/javascript" nonce="17782920174890.7381180260009492"> let newHref; try { setTimeout(() => { try { reportChallengeError("Reloaded without updating url", new Error("")); } catch (e) {} document.location.reload(); }, 20000); let referrer = document.referrer; let availableLength = maxLocationLength - document.location.href.length; if (encodeURIComponent(referrer).length > availableLength) { let parsedReferrer = new URL(referrer); referrer = parsedReferrer.origin; if (encodeURIComponent(referrer + parsedReferrer.pathname).length < availableLength) { referrer = referrer + parsedReferrer.pathname; } } let parameters = { chal_t: 1778292017489, force_referer: referrer, }; newHref = getNewUrlWithAddedParameter(document.location, parameters); } catch (e) { reportChallengeError("Failed while getting new href", e); } newHref = newHref || document.location.href; AwsWafIntegration.saveReferrer(); AwsWafIntegration.checkForceRefresh().then((forceRefresh) => { if (forceRefresh) { AwsWafIntegration.forceRefreshToken().then(() => { window.location.href = newHref; }); } else { AwsWafIntegration.getToken().then(() => { window.location.href = newHref; }); } }); </script> <noscript> <h1>JavaScript is disabled</h1> In order to continue, we need to verify that you're not a robot.0<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <title></title> <style> body { font-family: "Arial"; } </style> <script type="text/javascript" nonce="17785130355930.37093401404175186"> function getAjaxObject() { var ajax; if (window.XMLHttpRequest) { try { ajax = new window.XMLHttpRequest(); // XMLHttpRequest (Mozilla, Opera, Safari, etc.) } catch (e) { return false; } } else { var msXML = new Array( // XMLHttpRequest (IE with ActiveX) "Msxml2.XMLHTTP.5.0", "Msxml2.XMLHTTP.4.0", "Msxml2.XMLHTTP.3.0", "Msxml2.XMLHTTP", "Microsoft.XMLHTTP" ); for (var i = 0; i < msXML.length; i++) { // We want to get the best we can try { ajax = new ActiveXObject(msXML[i]); break; } catch (e) { return false; } } } return ajax; } function sendAjaxRequest(url, data, callback) { const xhr = getAjaxObject(); if (!xhr) { callback(new Error('Unable to create XMLHttpRequest object'), null); return; } xhr.open('POST', url, true); xhr.setRequestHeader('Content-Type', 'application/json'); xhr.setRequestHeader('Accept', 'application/json'); xhr.onreadystatechange = function() { if (xhr.readyState === 4) { if (xhr.status >= 200 && xhr.status < 300) { try { const response = JSON.parse(xhr.responseText); callback(null, response); } catch (error) { callback(error, null); } } else { callback(new Error('HTTP error! status: ' + xhr.status), null); } } }; xhr.onerror = function() { callback(new Error('Network error'), null); }; xhr.send(JSON.stringify(data)); } function reportChallengeError(log, challengeError) { try { sendAjaxRequest( 'https://reports.booking.com/chal_report', { log: log, message: challengeError.message, stack: challengeError.stack }, (e, response) => { if (e) { console.error('Request failed:', e); } else { console.log('Success:', response); } } ); } catch (e) {} } function setupErrorHandling() { // Handle JavaScript errors window.addEventListener('error', function(event) { var error = { message: event.message, stack: event.error ? event.error.stack : '' }; reportChallengeError('javascript_error', error); }); // Handle unhandled promise rejections window.addEventListener('unhandledrejection', function(event) { var error = { message: event.reason && event.reason.message ? event.reason.message : 'Unhandled Promise Rejection', stack: event.reason && event.reason.stack ? event.reason.stack : '' }; reportChallengeError('promise_rejection', error); }); } // Initialize error handling setupErrorHandling(); </script> <script type="text/javascript" nonce="17785130355930.37093401404175186"> window.awsWafCookieDomainList = ['booking.com']; </script> <script type="text/javascript" src="https://www.booking.com/__challenge_h78IRKX3kpQxScCExxShBNwRUlb/d8c14d4960ca/a18a4859af9c/challenge.js" nonce="17785130355930.37093401404175186"></script> <script type="text/javascript" nonce="17785130355930.37093401404175186"> const maxLocationLength = 2047 - "&chal_t=1760623098515&force_referer=".length; function searchStringWithNewParam(search, key, value) { value = encodeURIComponent(value); if (!search.startsWith('?')) { return search + `?${key}=${value}`; } else if (search.endsWith('&')) { return search + `${key}=${value}`; } else { return search + `&${key}=${value}`; } } function getNewUrlWithAddedParameter(location, parameters) { let newSearch = location.search; for (let parameterName of Object.keys(parameters)) { if (!newSearch.includes(`${parameterName}=`)) { newSearch = searchStringWithNewParam(newSearch, parameterName, parameters[parameterName]); } } let newHref = `${location.pathname}${newSearch}${location.hash}`; if (newHref.length < maxLocationLength) { return newHref; } return null; } </script> </head> <body> <div id="challenge-container"></div> <script type="text/javascript" nonce="17785130355930.37093401404175186"> let newHref; try { setTimeout(() => { try { reportChallengeError("Reloaded without updating url", new Error("")); } catch (e) {} document.location.reload(); }, 20000); let referrer = document.referrer; let availableLength = maxLocationLength - document.location.href.length; if (encodeURIComponent(referrer).length > availableLength) { let parsedReferrer = new URL(referrer); referrer = parsedReferrer.origin; if (encodeURIComponent(referrer + parsedReferrer.pathname).length < availableLength) { referrer = referrer + parsedReferrer.pathname; } } let parameters = { chal_t: 1778513035593, force_referer: referrer, }; newHref = getNewUrlWithAddedParameter(document.location, parameters); } catch (e) { reportChallengeError("Failed while getting new href", e); } newHref = newHref || document.location.href; AwsWafIntegration.saveReferrer(); AwsWafIntegration.checkForceRefresh().then((forceRefresh) => { if (forceRefresh) { AwsWafIntegration.forceRefreshToken().then(() => { window.location.href = newHref; }); } else { AwsWafIntegration.getToken().then(() => { window.location.href = newHref; }); } }); </script> <noscript> <h1>JavaScript is disabled</h1> In order to continue, we need to verify that you're not a robot.
Stay ahead of the changes

Watch this before it changes again

Follow unlimited companies, monitor the clauses that matter across every platform, and get the full institutional analysis on what each change obligates you to do.