agentscope-ai / agentscope-ai/QwenPaw

[Bug] OpenAI-compatible provider gets Cloudflare 403 when connecting to WUSRouter

Open
#7,587 4 comments 0 reactions 1 assignee Claimed by @wangfei010313 View on GitHub
Dominant language
Python
Stars
34.9k
Forks
3.1k
Avg merge
1d 15h
Merged PRs (30d)
225

Description

# [Bug] OpenAI-compatible provider gets Cloudflare 403 when connecting to WUSRouter

## Describe the bug

When using WUSRouter as an OpenAI-compatible provider in QwenPaw, **fetching the model list fails with HTTP 403**. The response body is a Cloudflare "Just a moment..." managed challenge page instead of the expected JSON model list.

The blocked request is:

```
GET https://api.wusrouter.com/v1/models
```

The Cloudflare challenge page confirms the zone:

```
api.wusrouter.com
```

## Configuration

- OS: Linux (container)
- QwenPaw version: 2.2.0
- Provider: WUSRouter
- Protocol: OpenAI-compatible
- Base URL: https://api.wusrouter.com/v1
- Model: deepseek-v4-flash-vision-exp

## Steps to Reproduce

1. In QwenPaw, add WUSRouter as an OpenAI-compatible provider (Base URL: `https://api.wusrouter.com/v1`)
2. Trigger "fetch model list" (when configuring the provider / testing the model)
3. The request to `GET /v1/models` is blocked: HTTP 403 with a Cloudflare "Just a moment..." challenge page

## Actual behavior

When fetching the model list, QwenPaw receives HTTP 403 with a Cloudflare managed challenge page instead of the JSON model list.

Key log excerpt (Cloudflare challenge page):

```html
Just a moment...
...
cUPMDTk: "/v1/models?__cf_chl_tk=..."
cZone: "api.wusrouter.com"
...
```

(The full response is a standard Cloudflare managed challenge page with `cType: managed`.)

## Expected behavior

QwenPaw should be able to call `GET /v1/models` on a Cloudflare-protected OpenAI-compatible endpoint and receive the JSON model list.

## Additional investigation

The same endpoint works fine with curl from the same network:

```bash
curl https://api.wusrouter.com/v1/models -H "Authorization: Bearer "
```

returns the model list (`deepseek-v4-flash`, `deepseek-v4-flash-0731`, `deepseek-v4-flash-0731-premium`, `deepseek-v4-flash-vision-exp`), which confirms:

1. The Base URL is correct.
2. The API key is valid.
3. `/v1/models` is accessible from the same network.
4. The failure happens specifically when QwenPaw's HTTP client calls the endpoint.

## Possible cause

It appears QwenPaw's HTTP request (headers, TLS fingerprint, or User-Agent) triggers WUSRouter's Cloudflare bot protection, while curl does not.

Could you please investigate whether QwenPaw's OpenAI-compatible HTTP client is compatible with Cloudflare-protected OpenAI-compatible APIs? It would also help if QwenPaw could detect a Cloudflare Challenge HTML response and surface a clearer error message instead of a generic 403.

Thank you.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.