Cross-post of [Bug] reqwest HTTP clients missing User-Agent override → Cloudflare 403 from HKG edge on Codex Desktop 26.422.x · Issue #18456 · openai/codex · GitHub — posting here since Community is OpenAI-staff-monitored.
Version: Codex Desktop 26.422.2437.0 (MSIX, Microsoft Store, Windows 11)
Location: Vietnam (tested on Viettel 5G + corporate ADSL, both route through Cloudflare HKG POP)
Same account works fine on a different computer.
Root cause (confirmed via curl from the affected machine):
curl -A "reqwest/0.12.0" https://chatgpt.com/backend-api/plugins/featured→ 403 (Cloudflare)curl -A "Codex-Desktop/26.422.2437.0" ...same URL...→ 401 (auth challenge — passes CF)curl -A "Mozilla/5.0 Chrome/131" ...same URL...→ 200
-> Cloudflare WAF at HKG is blocking the default reqwest/* User-Agent.
→ Some Codex Rust HTTP clients are not overriding the UA (logs show codex_analytics,
codex_core::plugins::manager, codex_core::plugins::startup_sync all hitting 403).
Impact: plugins marketplace empty, slash commands gone from UI, Fast Mode unavailable,
settings menu broken. No local workaround — needs either (a) set UA on all reqwest
clients in Codex, or (b) allowlist reqwest/* at CF edge.
Full reproduction + logs in GitHub issue #18456.