header 黑名单中增加过滤 `cf-warp-tag-id`、`cdn-loop`

[NewEpoch2020]

- 问题现象：

• 直连某第三方 Claude API 成功。
• 同参数经 Cloudflare Tunnel -> CCH 调用失败，CCH 日志出现上游 418 I'm a Teapot + Access Denied。

- 根因：

• CCH 透传了 Cloudflare 入口头 cf-warp-tag-id（以及可能的 cdn-loop）到上游。
• 某些第三方网关/WAF会将该类头视为异常流量并拒绝（418）。

- 排查结论与修复：

• 已确认：去掉 cf-warp-tag-id 后同请求恢复 200。
• 代码侧建议：在 CCH header 黑名单中增加过滤 cf-warp-tag-id、cdn-loop。（src/app/v1/_lib/headers.ts）

    const defaultBlacklist = [
      ...

      // CDN/云服务商特定头
      ...
      "cf-warp-tag-id", // Cloudflare WARP 标识（透传到上游可能触发风控/拦截）
      "cdn-loop", // CDN 回环检测头（仅入口 CDN 使用，不应透传）
      ...

[github-actions]

Thank you for this issue and the detailed root cause analysis.

Analysis:
I verified the header blacklist implementation in . The blacklist already filters several Cloudflare-related headers (lines 46-50):

• • Cloudflare 客户端 IP
• • Cloudflare 客户端国家
• • Cloudflare 请求追踪 ID
• • Cloudflare 访问者信息
• • Cloudflare Enterprise / Akamai

However, you are correct that and are currently missing from the blacklist. Your suggested fix to add these headers in the "CDN/云服务商特定头" section is accurate.

Verification:

• The class at line 20-90 handles header filtering
• The blacklist is applied in the method (lines 95-117) which filters headers before forwarding to upstream providers
• The blacklist uses case-insensitive matching (line 83: )

Suggested implementation:
Add the following entries after line 50 (after ):

This follows the same pattern as the existing Cloudflare header entries and will prevent these headers from being forwarded to upstream providers.

---

Automated response from Claude AI

[github-actions]

Thank you for this issue and the detailed root cause analysis.

Analysis:
I verified the header blacklist implementation in . The blacklist already filters several Cloudflare-related headers (lines 46-50):

• • Cloudflare 客户端 IP
• • Cloudflare 客户端国家
• • Cloudflare 请求追踪 ID
• • Cloudflare 访问者信息
• • Cloudflare Enterprise / Akamai

However, you are correct that and are currently missing from the blacklist. Your suggested fix to add these headers in the CDN/云服务商特定头 section is accurate.

Verification:

• The class at line 20-90 handles header filtering
• The blacklist is applied in the method (lines 95-117) which filters headers before forwarding to upstream providers
• The blacklist uses case-insensitive matching (line 83: )

Suggested implementation:
Add the following entries after line 50 (after ):

This follows the same pattern as the existing Cloudflare header entries and will prevent these headers from being forwarded to upstream providers.

---

Automated response from Claude AI

[github-actions]

Thank you for this issue and the detailed root cause analysis.

Analysis:
I verified the header blacklist implementation in src/app/v1/_lib/headers.ts. The blacklist already filters several Cloudflare-related headers (lines 46-50):

• cf-connecting-ip - Cloudflare 客户端 IP
• cf-ipcountry - Cloudflare 客户端国家
• cf-ray - Cloudflare 请求追踪 ID
• cf-visitor - Cloudflare 访问者信息
• true-client-ip - Cloudflare Enterprise / Akamai

However, you are correct that cf-warp-tag-id and cdn-loop are currently missing from the blacklist. Your suggested fix to add these headers in the CDN/云服务商特定头 section is accurate.

Verification:

• The HeaderProcessor class at line 20-90 handles header filtering
• The blacklist is applied in the process() method (lines 95-117) which filters headers before forwarding to upstream providers
• The blacklist uses case-insensitive matching (line 83: .toLowerCase())

Suggested implementation:
Add the following entries after line 50 (after true-client-ip):

      "cf-warp-tag-id", // Cloudflare WARP 标识（透传到上游可能触发风控/拦截）
      "cdn-loop", // CDN 回环检测头（仅入口 CDN 使用，不应透传）

This follows the same pattern as the existing Cloudflare header entries and will prevent these headers from being forwarded to upstream providers.

---

Automated response from Claude AI