infra: server IP blocked by Microsoft — migrate to Cloudflare Worker proxy #6

New issue

Closed

opened 2026-05-18 11:32:27 +05:30 by starkSV · 0 comments

starkSV commented

2026-05-18 11:32:27 +05:30

(Migrated from github.com)

Problem

The Go backend proxies all requests to Microsoft's software-download-connector API from a single server IP. When traffic volume is high enough, Microsoft temporarily blocks that IP (error code 715-123130), making the "Get Download Links" button fail for all users simultaneously.

This is the same flow used by the Fido script (Rufus), but Fido runs client-side on the user's own machine — each user's residential IP makes its own request. Our server aggregates all users behind one datacenter IP, which Microsoft rate-limits aggressively.

Proposed fix

Route outbound Microsoft API calls through a Cloudflare Worker instead of directly from the server. Cloudflare's edge network distributes requests across many IPs globally, so no single IP accumulates enough volume to trigger a block.

Architecture change:

Before: Browser → Go backend → Microsoft API (single server IP)
After: Browser → Go backend → CF Worker → Microsoft API (distributed edge IPs)

The Worker is ~20 lines of JS and the backend change is an env-var-gated swap of the target URL. Self-hosters can opt out by leaving the env var unset.

Why not client-side fetching?

Microsoft's API does not return Access-Control-Allow-Origin headers, so direct browser → Microsoft calls are blocked by CORS. The CF Worker approach gives the same distributed-IP benefit without requiring CORS support.

References

Fido script: https://github.com/pbatard/Fido

## Problem The Go backend proxies all requests to Microsoft's software-download-connector API from a single server IP. When traffic volume is high enough, Microsoft temporarily blocks that IP (error code 715-123130), making the "Get Download Links" button fail for all users simultaneously. This is the same flow used by the Fido script (Rufus), but Fido runs client-side on the user's own machine — each user's residential IP makes its own request. Our server aggregates all users behind one datacenter IP, which Microsoft rate-limits aggressively. ## Proposed fix Route outbound Microsoft API calls through a **Cloudflare Worker** instead of directly from the server. Cloudflare's edge network distributes requests across many IPs globally, so no single IP accumulates enough volume to trigger a block. **Architecture change:** Before: Browser → Go backend → Microsoft API (single server IP) After: Browser → Go backend → CF Worker → Microsoft API (distributed edge IPs) The Worker is ~20 lines of JS and the backend change is an env-var-gated swap of the target URL. Self-hosters can opt out by leaving the env var unset. ## Why not client-side fetching? Microsoft's API does not return `Access-Control-Allow-Origin` headers, so direct browser → Microsoft calls are blocked by CORS. The CF Worker approach gives the same distributed-IP benefit without requiring CORS support. ## References - Fido script: https://github.com/pbatard/Fido