agentscope-ai / agentscope-ai/QwenPaw
[Bug] OpenAI-compatible provider gets Cloudflare 403 when connecting to WUSRouter
- Dominant language
- Python
- Stars
- 34.9k
- Forks
- 3.1k
- Avg merge
- 1d 15h
- Merged PRs (30d)
- 225
Description
# [Bug] OpenAI-compatible provider gets Cloudflare 403 when connecting to WUSRouter
## Describe the bug
When using WUSRouter as an OpenAI-compatible provider in QwenPaw, **fetching the model list fails with HTTP 403**. The response body is a Cloudflare "Just a moment..." managed challenge page instead of the expected JSON model list.
The blocked request is:
```
GET https://api.wusrouter.com/v1/models
```
The Cloudflare challenge page confirms the zone:
```
api.wusrouter.com
```
## Configuration
- OS: Linux (container)
- QwenPaw version: 2.2.0
- Provider: WUSRouter
- Protocol: OpenAI-compatible
- Base URL: https://api.wusrouter.com/v1
- Model: deepseek-v4-flash-vision-exp
## Steps to Reproduce
1. In QwenPaw, add WUSRouter as an OpenAI-compatible provider (Base URL: `https://api.wusrouter.com/v1`)
2. Trigger "fetch model list" (when configuring the provider / testing the model)
3. The request to `GET /v1/models` is blocked: HTTP 403 with a Cloudflare "Just a moment..." challenge page
## Actual behavior
When fetching the model list, QwenPaw receives HTTP 403 with a Cloudflare managed challenge page instead of the JSON model list.
Key log excerpt (Cloudflare challenge page):
```html
Just a moment...
...
cUPMDTk: "/v1/models?__cf_chl_tk=..."
cZone: "api.wusrouter.com"
...
```
(The full response is a standard Cloudflare managed challenge page with `cType: managed`.)
## Expected behavior
QwenPaw should be able to call `GET /v1/models` on a Cloudflare-protected OpenAI-compatible endpoint and receive the JSON model list.
## Additional investigation
The same endpoint works fine with curl from the same network:
```bash
curl https://api.wusrouter.com/v1/models -H "Authorization: Bearer "
```
returns the model list (`deepseek-v4-flash`, `deepseek-v4-flash-0731`, `deepseek-v4-flash-0731-premium`, `deepseek-v4-flash-vision-exp`), which confirms:
1. The Base URL is correct.
2. The API key is valid.
3. `/v1/models` is accessible from the same network.
4. The failure happens specifically when QwenPaw's HTTP client calls the endpoint.
## Possible cause
It appears QwenPaw's HTTP request (headers, TLS fingerprint, or User-Agent) triggers WUSRouter's Cloudflare bot protection, while curl does not.
Could you please investigate whether QwenPaw's OpenAI-compatible HTTP client is compatible with Cloudflare-protected OpenAI-compatible APIs? It would also help if QwenPaw could detect a Cloudflare Challenge HTML response and surface a clearer error message instead of a generic 403.
Thank you.
Contributor guide
Assessment
This issue has not been assessed yet.