CommandBox 6.3.5 package download returns 403 with hardcoded IE9 user-agent

Communities CommandBox CLI
1

CommandBox 6.3.5 package download returns 403 with hardcoded IE9 user-agent

Hi everyone,

Our GitHub Actions deployment started failing during:

box install --production

The error occurs downloading our locked ColdBox 7.5.2+27 dependency:

403 Forbidden
https://downloads.ortussolutions.com/ortussolutions/coldbox/7.5.2/coldbox-7.5.2.zip

Environment:

  • GitHub Actions, ubuntu-latest
  • Java 21
  • Reproduced with CommandBox 6.3.3 and 6.3.5
  • Setup action Ortus-Solutions/setup-commandbox@v2.0.1

On the same GitHub runner, curl downloaded the ZIP successfully while CommandBox returned 403.

We then tested the user-agent. Requests using the exact hardcoded value from ProgressableDownloader.cfc returned 403:

Mozilla /5.0 (Compatible MSIE 9.0;Windows NT 6.1;WOW64; Trident/5.0)

Changing only the user-agent to this returned 200:

CommandBox/6.3.5

Our temporary CI workaround replaces that header in the disposable runner’s CommandBox installation before running box install --production. The full dependency install and deployment then succeed without changing dependency versions or the lock file.

This suggests the download service is rejecting the older user-agent.

Is there a supported configuration for overriding this header, or should the hardcoded downloader user-agent be updated?

Thanks!

2

Hello @b_w
Issue was releated with some rules we deployed in our CDN, we already fixed it. You should be able to install packages again.

Regards!

3

We can update the user agent. We put that hard coded agent in there years ago, ironically to solve issues with firewalls blocking Lucee’s default HTTP agent as looking like a bot. Though, it seems like the agent itself wasn’t really the issue, but a configuration issue on our own CloudFlare firewall.