https://bugs.kde.org/show_bug.cgi?id=528000
Bug ID: 528000
Summary: HTTP 403 Forbidden on bugs.kde.org caused by
WAF/reverse proxy blocking standard Opera desktop
browser
Classification: Websites
Product: bugs.kde.org
Version First unspecified
Reported In:
Platform: Other
OS: Other
Status: REPORTED
Severity: normal
Priority: NOR
Component: general
Assignee: [email protected]
Reporter: [email protected]
CC: [email protected]
Target Milestone: ---
Component:
Websites / bugs.kde.org (or Sysadmin / Infrastructure)
Summary:
Navigating to bugs.kde.org or direct bug links returns an immediate HTTP 403
Forbidden error when using the Opera desktop browser on Windows. Thorough
isolation testing confirms that this is not caused by extensions, ad/tracker
blockers, or a network IP ban. Rather, it appears that the edge WAF / reverse
proxy heuristic or bot-mitigation layer is actively dropping standard Opera
client handshakes based on its default TLS/HTTP fingerprint or User-Agent
profile.
Steps to Reproduce:
Open the Opera desktop browser on Windows.
Ensure Opera VPN is disabled.
Open a clean Private Window (Ctrl + Shift + N) to ensure all third-party
extensions are disabled.
Verify in Opera Settings that both native "Block ads" and "Block trackers"
toggles are switched off.
Navigate to https://bugs.kde.org or any bug URL (e.g.
https://bugs.kde.org/show_bug.cgi?id=524566).
Observed Result:
Immediate HTTP 403 Forbidden error response from the front-end server/WAF. No
login interface, bug content, or interactive human verification prompt is
presented.
Expected Result:
The Bugzilla page should load normally, or present an interactive verification
challenge if the browser signature triggers security scrutiny.
Diagnostic & Isolation Notes:
Extensions Ruled Out: Reproducible in a clean Private Window where all user
extensions are disabled.
Ad/Tracker Blockers Ruled Out: Reproducible with both built-in ad blocking and
tracking protection explicitly toggled off in browser settings.
IP / Network Ruled Out: Navigating to the exact same URLs from the identical
PC and IP address using standard Microsoft Edge succeeds immediately with zero
friction.
Likely Root Cause: The reverse proxy / WAF heuristic rules are flagging
Opera's raw TLS cipher suite order (JA3/JA4 fingerprint) or Chromium User-Agent
header pattern as automated/scraping traffic, resulting in a false-positive
drop of legitimate desktop Opera users.
--
You are receiving this mail because:
You are watching all bug changes.
