HttpService is blocking my Roblox proxy for "HttpService is not allowed to access ROBLOX resources)"

[Scriptifer]

I get an error code 403 when running this script.

local HttpService = game:GetService("HttpService")
HttpService:GetAsync("https://games.hoi-c.net/v1/games/" .. game.PlaceId .. "/servers/0?sortOrder=2&excludeFullGames=true&limit=10")

Actual behaviour:
The script throws an error HTTP 403 (HttpService is not allowed to access ROBLOX resources) after some delay (waiting to receive response).
Expected behaviour:
Return the response as normal.

[Brylan_Leske (Brylan)]

@Scriptifer

https://games.hoi-c.net/v1/games/

How is your proxy set up? any cors changes, etc?

I did notice that certain headers are still being sent through your proxy such as

x-roblox-edge: lhr2
x-roblox-region: us-central_rbx
Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://ncs.roblox.com/upload"}]}
roblox-machine-id: 4e9a402b-a304-ab92-6112-2cfdb38b381a

Some of which might be detected by the roblox server and then denied.

[Scriptifer]

My proxy works by using the IIS (by Microsoft) Rewrite module.

[Scriptifer]

I tried setting the Report-To header to an empty string, didn’t work either, but I noticed that another major Roblox proxy roproxy also contains these headers and isn’t blocked.

[thirdtakeonit]

Thanks for the report! We’ll follow up when we have an update for you.

[juliaoverflow (julia)]

@Scriptifer

The script throws an error HTTP 403 (HttpService is not allowed to access ROBLOX resources) after some delay (waiting to receive response).

Try filtering out the roblox-id header from the request on the proxy’s backend.

[effward]

Could you try what julia suggested and report back?

[Scriptifer]

I’m not sure if that’s possible on IIS 10.0, this issue seems to only occur when IIS Rewrite Module is used for Roblox proxy.

[Scriptifer]

Ok, I got this fixed by just using reverse proxy on localhost http server that forwards the requests to Roblox API, using reverse proxy directly on Roblox APIs, will cause an issue making HttpService think it’s a Roblox domain, I believe this other method needs to be fixed.

[Scriptifer]

This causes the issue:

But using localhost server as the reverse proxy to forward requests to Roblox works:

{C:1} is the subdomain and {R:0} is the absolute path.