can't import any feedburner feeds

[shadow-absorber]

Describe the bug
any feedburner feed being imported gives a 403

To Reproduce
yang991178#629

Expected behaviour
feed imports and can be read

Platform (please complete the following information):

• OS: arch linux
• Version: dev 2.0.0
• (optional) Package type: AppImage

Additional context
see bug report here: yang991178#629

And see pull request here: yang991178#633

[CrystalSplitter]

This appears to be user-agent based from this comment: https://www.reddit.com/r/rss/comments/14kbiqw/problem_adding_a_rss_feed_to_fluent_reader/naaux8m/

Repeating it below so it lasts longer:

You can deploy a simple application on Cloudflare Worker to modify your User-Agent, then add the Worker’s URL to your Fluent Reader.

javascript export default { async fetch(request, env, ctx) { const targetUrl = 'https://feeds2.feedburner.com/programthink' const response = await fetch(targetUrl, { headers: { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)', }, }) return new Response(await response.text(), { headers: { 'Content-Type': 'application/xml' }, }) }, }

For a detailed tutorial, you can check my blog: https://yimang.tw/posts/fluent-reader-403/ (but it’s written in Chinese).

Ideally though, I'd prefer if we don't fuck with the user agent. Maybe we can get in contact with Feedburner devs?

[CrystalSplitter]

Actually, seems that it's a CORS/Sec-Fetch-Site issue, as I tried both of these out:

Fails:

curl --user-agent 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.7339.249 Electron/38.6.0 Safari/537.36' \
-H 'Sec-Fetch-Site: cross-site' \
https://feeds.feedburner.com/TheHackersNews

Succeeds:

curl --user-agent 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.7339.249 Electron/38.6.0 Safari/537.36' \
-H 'Sec-Fetch-Site: none' \
https://feeds.feedburner.com/TheHackersNews

[CrystalSplitter]

I see why yang991178#633 is probably the best solution. Indeed, we don't want the render-space scripts doing non-cross-origin requests as it is a security concern. We should move this into the main processor space wherever possible.

[shadow-absorber]

thank you