doordash

DoorDash (doordash.com)

React SPA served through Cloudflare. Deal pages are server-side rendered with all items inlined in the initial HTML — don't bother with the GraphQL endpoints. A headed stealth Puppeteer session clears the Cloudflare challenge automatically; no captcha solver or proxy needed.

Detection

Signal	Value
CDN	Cloudflare (cf-ray, cf-mitigated, "Just a moment..." on raw curl)
Framework	React SPA with SSR bootstrap
Anti-bot	Cloudflare Managed Challenge — clears via stealth plugin, no CAPTCHA
Rendering	SSR for deals carousels; GraphQL for personalized/auth surfaces
Auth	Not required for /browse/deals
Geo	Results vary by geoIP — default US egress lands in SF 94107

Strategy

Puppeteer (stealth, headed)
  → wait for networkidle2
  → scroll to trigger lazy sections
  → parse rendered HTML with Cheerio

Do NOT hit the GraphQL endpoints:

• /graphql/homeLandingPageStores, getGeoByIP, etc. fire on page load but none return the deals feed.
• The typical facetFeed endpoint only fires on authenticated/personalized surfaces, not /browse/deals.
• The deals feed is inlined in the SSR HTML — parse that directly.

Stealth config that works

import puppeteer from "puppeteer-extra";
import StealthPlugin from "puppeteer-extra-plugin-stealth";
puppeteer.use(StealthPlugin());

const browser = await puppeteer.launch({
  headless: false,
  args: [
    "--no-sandbox",
    "--disable-setuid-sandbox",
    "--disable-blink-features=AutomationControlled",
  ],
});

const page = await browser.newPage();
await page.goto("https://www.doordash.com/browse/deals", { waitUntil: "networkidle2" });

Standard Chrome UA is fine — no rotation needed. Cloudflare clears on its own once JS runs.

Verify you're past the challenge before parsing:

const title = await page.title();
if (title !== "Deals | Doordash") {
  throw new Error(`Unexpected page title: ${title} — Cloudflare may still be challenging`);
}