API Post from one Glitch application to a second fails with 403 status Code

[donovat]

I have a Glitch Nodejs apps that is posting (using require.post ) to a second Glitch nodejs express app. However all the ‘post’ requests fail with a status code of 403, and a web page, that implies that the receiving Glitch app is a sleep or missing. I can send data via curl, and get a valid response, and the second app registers the post from curl. But not from the first glitch application. I can also post from the first app to Postman’s echo site, and get a valid response, and the data is received ok. So it seems that Glitch is failing to catch the post and respond in time. How can Glitch work as an API services (even for testing), if it loose messages.

[RiversideRocks]

This is likely happening because of the ping block. Glitch probably thinks you are trying to ping a project.

Very sorry about this!

[donovat]

Not sure why it thinks this is a ping. Its a direct call to an app end point. Does this mean one glitch application cannot work with another glitch application?

[RiversideRocks]

I’m afraid not at this time.

[youngchief]

Probably because there were some auto-pingers made ON GLITCH.

[donovat]

Thanks for the clarification. May I suggest it could be worth documenting this point somewhere.

[RiversideRocks]

I suppose you could ask support@glitch.com about that. Its a good idea.

[wh0]

@donovat

I can send data via curl, and get a valid response, and the second app registers the post from curl. But not from the first glitch application.

You have to send a User-Agent header in your request, or Glitch will block it. Unhelpful that they never documented this, isn’t it?

A link to a post with a quote allegedly from Glitch support on the matter:

Unable to connect to websocket from Unity

Hi there. Just heard back from support: “I just got an update from the team. It looks like we are blocking Unity because the requests are missing a User-Agent header. Glitch does require that this information be present in order for your project to accept the requests.” I am not 100% sure how this works, but there is a function meant to set the request header of the websocket client options (public void SetRequestHeader (string headerName, string headerValue);). But what would be the headern…

[donovat]

Well I have tried using a header value for “User-Agent” both a real name of the application, and a spoof “curl” one. Neither worked.

[chessebuilderman]

@wh0

You have to send a User-Agent header in your request, or Glitch will block it. Unhelpful that they never documented this, isn’t it?

This is not true. I can send request to my project from my Vultr instance. What it actually checks for is the IP. VPS providers can shutdown instances that breaks TOS of other websites instantly. But auto pingers have IPs that they use, and since there were so many people on Glitching using pingers, it was easy to filter out where they were coming from. Also Glitch can email companies and request the IPs.