[itch] 撞 CF 403 了

11:03:06.394 userscript.html?name=Redeem-itch.io.user.js&id=77ed211f-b5f3-4fd9-9776-00f861b794cd:161 当前游戏/优惠包链接: <br/>https://jjisawes0m.itch.io/the-secrets-of-simon-mountain/purchase
11:03:06.397 userscript.html?name=Redeem-itch.io.user.js&id=77ed211f-b5f3-4fd9-9776-00f861b794cd:161 当前游戏链接: <br/>https://jjisawes0m.itch.io/the-secrets-of-simon-mountain
11:03:06.400 userscript.html?name=Redeem-itch.io.user.js&id=77ed211f-b5f3-4fd9-9776-00f861b794cd:161 正在检测游戏是否拥有...<br/>https://jjisawes0m.itch.io/the-secrets-of-simon-mountain
11:03:09.216 userscript.html?name=Redeem-itch.io.user.js&id=77ed211f-b5f3-4fd9-9776-00f861b794cd:161 请求失败！
11:03:09.216 userscript.html?name=Redeem-itch.io.user.js&id=77ed211f-b5f3-4fd9-9776-00f861b794cd:136 ObjectDONE: 4HEADERS_RECEIVED: 2LOADING: 3OPENED: 1RESPONSE_TYPE_ARRAYBUFFER: "arraybuffer"RESPONSE_TYPE_BLOB: "blob"RESPONSE_TYPE_DOCUMENT: "document"RESPONSE_TYPE_JSON: "json"RESPONSE_TYPE_STREAM: "stream"RESPONSE_TYPE_TEXT: "text"UNSENT: 0finalUrl: "https://jjisawes0m.itch.io/the-secrets-of-simon-mountain"readyState: 4responseHeaders: "accept-ch:Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA\r\ncf-mitigated:challenge\r\ncf-ray:a1a2b3c45bead60f-MCI\r\ncontent-encoding:br\r\ncontent-security-policy:default-src 'none'; script-src 'nonce-ga1asKZueCQpsQZVySWQ1H' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self'\r\ncontent-type:text/html; charset=UTF-8\r\ncritical-ch:Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA\r\ncross-origin-embedder-policy:require-corp\r\ncross-origin-opener-policy:same-origin\r\ncross-origin-resource-policy:same-origin\r\ndate:Mon, 13 Jul 2026 02:03:14 GMT\r\nnel:{\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\norigin-agent-cluster:?1\r\npermissions-policy:accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=(),xr-spatial-tracking=*\r\nreferrer-policy:same-origin\r\nreport-to:{\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TOgA4Xh3Xg%2FM1fE6qHzbW%2FBzGvFYUlMca7JaWLVErBAIDMWQmr0mUNk4Eyx%2FgZQTXdQLn1Ij0n9%2BUQyyqRSW0jUVYvcLatl92ss%2ByNgPjo%2FnKqTurxAq0dU3%2FJH%2BD4MQ2tvb7A%3D%3D\"}]}\r\nserver:cloudflare\r\nserver-timing:chlray;desc=\"a1a4b5c35bead30f\"\r\nvary:accept-encoding\r\nx-content-type-options:nosniff\r\nx-frame-options:SAMEORIGIN"responseType: undefinedstatus: 403statusText: ""toString: ()=>"[object Object]"response: (...)responseText: (...)responseXML: (...)get response: ƒ get()get responseText: ƒ get()get responseXML: ƒ get()

但是亲自点 Claim 却不会触发 CF 阻挡，就连转圈的等待验证的画面都没有。

Start with the generated Redeem-itch.io.user.js entry points shown at lines 161 and 136, then reproduce the itch.io purchase check using the reported URL. Compare the request that receives the Cloudflare 403 with the normal Claim flow. Done means the reported check no longer fails incorrectly, with the behavior covered by an appropriate regression check if the project has one.