MajorGeeks RSS - 201 forbidden

[vandreytrindade]

Hi!

I have this RSS for ages: https://www.majorgeeks.com/files/rss
And now it keeps throwing 201 forbidden error.

Have tried with some online RSS readers and it is working.
Any idea?

[dsalt]

Looks like Cloudflare is the cause. I'm seeing the same with http://www.phoronix.com/rss.php.

[vandreytrindade]

It seems that this project isn't updated anymore... I'm trying to find alternatives.

[Fixer-007]

Same with http://www.ghacks.net/feed/

[vandreytrindade]

It's working again =)

[danielscsc]

Same with https://joshtronic.com/feed/
Any suggestions?

[danhaber]

It is Cloudflare. Cloudflare returns a 403 to QuiteRSS, which for some reason shows it as 201. See request/response here:

FWIW, changing the Chrome browser version to something newer (in the User-Agent header) seems to fix it.

[danhaber]

Workaround-Solution: Patch the Version String in QuiteRSS.exe

QuiteRSS contains a hardcoded User-Agent header of 77.0.3865.120, which causes issues with Cloudflare fingerprinting.

You can patch it to something newer using a hex editor like HxD:

1. Open QuiteRSS.exe in HxD.
2. Press Ctrl + F, select "Hex-values", and search for:

37 37 2E 30 2E 33 38 36 35 2E 31 32 30

(this is 77.0.3865.120 in ASCII)

3. Replace it with:

31 33 38 2E 30 2E 33 38 36 35 2E 31 32 00

(this is 138.0.3865.120 + null terminator)

4. Save the file (Ctrl + S).

[dsalt]

That implies the following patch:

--- ./src/main/globals.cpp~	2020-04-21 05:39:19.000000000 +0100
+++ ./src/main/globals.cpp	2025-05-18 21:07:08.300759435 +0100
@@ -95,7 +95,7 @@
   Settings settings;
   settings.beginGroup("Settings");
   noDebugOutput_ = settings.value("noDebugOutput", true).toBool();
-  userAgent_ = settings.value("userAgent", "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36").toString();
+  userAgent_ = settings.value("userAgent", "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.3865.120").toString();
 
   isInit_ = true;
 }

Doesn't work, though. I get the same Forbidden (201) from Phoronix.

[danhaber]

Doesn't work, though. I get the same Forbidden (201) from Phoronix.

Hmm, worked for me. What do you get with curl (swap out the url)? I was using this curl command to debug:

curl -I -X GET "http://joshtronic.com/feed/" ^
  -H "Accept: application/atom+xml,application/rss+xml;q=0.9,application/xml;q=0.8,text/xml;q=0.7,*/*;q=0.6" ^
  -H "Accept-Encoding: gzip, deflate" ^
  -H "Accept-Language: en-US,*" ^
  -H "Connection: Keep-Alive" ^
  -H "Host: joshtronic.com" ^
  -H "User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36"

or in 1-line for better Windows support:  

curl -I -X GET --location "https://www.phoronix.com/rss.php" -H "Accept: application/atom+xml,application/rss+xml;q=0.9,application/xml;q=0.8,text/xml;q=0.7,*/*;q=0.6" -H "Accept-Encoding: gzip, deflate" -H "Accept-Language: en-US,*" -H "Connection: Keep-Alive" -H "Host: www.phoronix.com" -H "User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.12"

which showed the 403 from Cloudflare. Changing the User-Agent resulted in a 200 response.

---

I just tested with https://www.phoronix.com/rss.php and it works for me 🤷‍♂

[dsalt]

User-Agent or, for that matter, the other added headers don't seem to matter at all. I haven't been able to get curl to fail, and I haven't yet been able to get QuiteRSS to succeed.

(Using Qt 5.15.8, as distributed in Devuan stable.)

[danhaber]

Strange. That was what fixed it for me in Windows. Can you try inspecting the request/response? I used HTTP-Toolkit (it sets up a proxy server on localhost:8000, you then tell QuiteRSS to use it as proxy). That should help you narrow down the issue.

[dsalt]

I tried mitmproxy with an unmodified QuiteRSS:

$ mitmdump -p 8000 --set block_global=false --flow-detail 4
Proxy server listening at 10.0.128.1:8000
10.0.128.1:45858: client connect
10.0.128.1:45858: server connect www.phoronix.com:443 ([2606:4700:20::681a:7e6]:443)
10.0.128.1:45858: GET https://www.phoronix.com/rss.php
    Host: www.phoronix.com
    Accept: application/atom+xml,application/rss+xml;q=0.9,application/xml;q=0.8,text/xml;q=0.7,*/*;q=0.6
    User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36
    Connection: Keep-Alive
    Accept-Encoding: gzip, deflate
    Accept-Language: en-GB,*

 << 200 OK 5.4k
    Date: Mon, 19 May 2025 17:05:51 GMT
    Content-Type: text/xml; charset=utf-8
    Transfer-Encoding: chunked

etc.

There's definitely something else going on here. It looks like we're requiring different workarounds on different OSes. Probably going to have to look at packet headers or something…

[danhaber]

Yep, definitely something different. You're getting a 200 response. I wonder if its related to ipv6 - can you force ipv4 and see if that helps?

[dsalt]

It's public IPv6 whether or not it's proxied, and eliminating the looked-up IPv6 addresses (via my local resolver) makes no difference other than using IPv4: it still works or not according to whether I'm using mitmdump.

[danhaber]

Hmm. According to this, the 201 is probably QNetworkReply::ContentAccessDenied. Searching online shows that often gzip'd contents can cause issues. What happens if you modify the Accept-Encoding header to not include gzip (or try something like Accept-Encoding: identity);

P.S. If you're building this from source by yourself, you can build it with debug flag instead of release (more here), and then utilize this.