fix(blender): send a real User-Agent so Cloudflare stops blocking the add-on

Submitting failed with a 403 before the request reached the server: Cloudflare error 1010, a browser-signature ban. Python's urllib identifies itself as "Python-urllib/3.x", which is exactly the scripted signature that rule targets. The AE panel was unaffected because curl sends curl/8.x, and the worker because .NET sends its own. Verified against the live zone, same request and token, only the agent changed: Python-urllib/3.11 gets 403 while VFXReviewBlender/1.0.1 gets 200 — as do curl and a browser agent. Naming the tool is also the honest thing: the studio's logs should say what is calling them, and the version travels with it. A Cloudflare block is also no longer reported to the artist as a wall of JSON about browser signatures — it says the firewall stopped the request before it reached the server, and to ask the pipeline TD. Add-on 1.0.1. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-15 19:11:52 +02:00
parent 70cf45ead4
commit 3733c0c4fa
2 changed files with 32 additions and 3 deletions
@@ -86,3 +86,11 @@ nothing in the UI sets them today — one place for render settings is the point
 **Exit code 0 with no frames is treated as a failure.** Blender exits cleanly
 when a frame range is empty or an output path is unwritable, so the worker
 checks that frames were actually saved before reporting success.
+
+**The add-on sends its own User-Agent** (`VFXReviewBlender/<version>`). Python's
+`urllib` otherwise identifies itself as `Python-urllib/3.x`, which Cloudflare
+blocks outright as a scripted signature — a 403 with error 1010 before the
+request ever reaches the server. Verified against the live zone: `Python-urllib`
+gets 403, the add-on's own agent gets 200. If a future Cloudflare rule blocks it
+anyway, the add-on says so in plain language rather than showing the raw JSON,
+and the fix is a WAF allow rule on the agent or on `/api/ext/*`.