X3Photo Gallery Forums

Ok. Anyway, for some reason, all your non-browser cURL requests are triggering Firewall challenges at Cloudflare.


This is a bit strange, because this behavior is not normal, and I can't just disable Cloudflare. I created a couple of RULES that should bypass the firewall when requesting the ZIP files, but it seems they are not triggering. Either it takes a little while, or there is something else, in which case I need to ask some questions in the Cloudflare community.


Please check a bit later (at least 4 hours from now) and then let's see. If still challenge, then I will need to post some questions to Cloudflare community. It's of course a bit strange that your cURL causes the Cloudflare challenge, as this is not normal.

May I ask what PHP version you are using? May I also ask what URL you are using? I mean, is it live domain or a private hostname or IP? I managed to recreate the same issue on my localhost, but it works fine on real domains. I will look into my own localhost tomorrow, cURL might not be configured correctly, or it is blocked on Cloudflare for the same reason as yours (although it's not showing up in firewall events yet).

One thing is 100% sure, the cause of the cURL failure for you, is Cloudflare firewall on our server. I will look into everything more closely tomorrow.

hyc wrote:could it be something on your side where you have a redirect

We don't actually use redirects. The files your request are physical paths, and Cloudflare wouldn't know (or care) about that anyway. It is blocking your cURL requests. There is a CURLOPT_FOLLOWLOCATION option in PHP, but it's not used because there are no redirects, and the issue is Cloudflare challenging the request as we can clearly see.

hyc wrote:? by any chance do you have another domain on which we can test to see ?

You mean for trying to cURL the zip? Yes many, but this won't offer anything useful. All our websites are on Cloudflare. The requests will likely fail like your current cURL, because Cloudflare has decided to challenge them for some reason.

I'll get back to you tomorrow.

Been doing some more tests, and this issue is 100% Cloudflare challenge (security), nothing more nothing less. Your request is blocked based on some "threat score", which is based on many factors. We don't want this challenge of course, especially since it's just a request to a static zip file. It gets complicated though, you can follow the post here:
https://community.cloudflare.com/t/curl ... ass/395744

In the meantime, I have specifically WHITELISTED your IP **5.**1.*6.*1, so it should work unless your IP changed since yesterday. I tried this myself, and resolved it for my own IP. This is not a proper solution of course.

hyc wrote:may i please ask you to also edit the image in your post

Done