From 2a8954663c88202a0ca3d59bd8aaf448895ae15a Mon Sep 17 00:00:00 2001 From: Paijo <14921983+oyi77@users.noreply.github.com> Date: Tue, 2 Jun 2026 04:14:39 +0700 Subject: [PATCH] fix(claude-web): inject cf_clearance into cookie for 403 prevention (#3046) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The execute() and testConnection() methods called normalizeClaudeSessionCookie() which does NOT inject cf_clearance. Cloudflare pins cf_clearance to TLS fingerprint — without it, requests get challenged with 403 even with valid session cookies. Changed both call sites to use normalizeClaudeSessionCookieWithAutoRefresh() which auto-injects cf_clearance via Turnstile solver when missing. Fixes: [403]: Claude Web API error: Co-authored-by: oyi77 --- open-sse/executors/claude-web.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/open-sse/executors/claude-web.ts b/open-sse/executors/claude-web.ts index 7309dfa1ca..0734556305 100644 --- a/open-sse/executors/claude-web.ts +++ b/open-sse/executors/claude-web.ts @@ -417,7 +417,7 @@ export class ClaudeWebExecutor extends BaseExecutor { return false; } - const cookieHeader = normalizeClaudeSessionCookie(rawCookie); + const cookieHeader = await normalizeClaudeSessionCookieWithAutoRefresh(rawCookie, { allowAutoSolve: false }); const deviceId = (credentials as any)?.deviceId as string | undefined; return await verifyCookieValidity(cookieHeader, deviceId, signal); @@ -479,7 +479,7 @@ export class ClaudeWebExecutor extends BaseExecutor { }; } - const cookieHeader = normalizeClaudeSessionCookie(rawCookie); + const cookieHeader = await normalizeClaudeSessionCookieWithAutoRefresh(rawCookie, { log }); const deviceId = (credentials as any)?.deviceId as string | undefined; // Transform request to Claude format