OkHttp3可连接Cloudflare防护网站，RestSharp遇403拦截问题排查

我通过两种方式调用同一个受Cloudflare DNS防护的REST API：Xamarin Android应用使用OkHttp3，C# WinForm应用使用RestSharp。当请求不符合Cloudflare验证要求时，会返回403“Sorry, you have been blocked”页面。目前OkHttp3调用正常，但RestSharp始终失败，已尝试匹配请求头仍无效果，API提供商未提供.NET技术支持。

OkHttp3 调用代码 #

RequestBody create = RequestBody.Create(MediaType.Parse("binary"), postdata);
Request.Builder builder = new Request.Builder();
builder.Url(url);

builder.AddHeader("Referer", "");
builder.AddHeader("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36");
builder.AddHeader("Connection", "keep-alive");
builder.AddHeader("content-type", "application/json");
builder.Post(create);

OkHttpClient client = xOKHttp.NewOkHttpClient(); 
string str = client.NewCall(builder.Build()).Execute().Body().String();

XOKHttp 工具类代码 #

class CustomHostnameVerifier : Java.Lang.Object, IHostnameVerifier
{            
    public bool Verify(string hostname, ISSLSession session)
    {
        return true;
    }
}

class CustomX509TrustManager : Java.Lang.Object, IX509TrustManager
{
    public void CheckClientTrusted(X509Certificate[] chain, string authType)
    {
        try { }
        catch(CertificateException e) { }
    }

    public void CheckServerTrusted(X509Certificate[] chain, string authType)
    {
        try { }
        catch (CertificateException e) { }
    }

    public X509Certificate[] GetAcceptedIssuers()
    {
        return new X509Certificate[0];
    }
}

public static OkHttpClient NewOkHttpClient()
{
    try
    {
        ITrustManager trustManagerArr = new CustomX509TrustManager();

        SSLContext instance = SSLContext.GetInstance("SSL");
        
        instance.Init((IKeyManager[]) null, new ITrustManager[] { trustManagerArr }, new SecureRandom());
        SSLSocketFactory socketFactory = instance.SocketFactory;
        
        OkHttpClient.Builder builder = new OkHttpClient.Builder();
        
        builder.SslSocketFactory(socketFactory, (IX509TrustManager)trustManagerArr);
        builder.HostnameVerifier(new CustomHostnameVerifier());
        builder.RetryOnConnectionFailure(false);
        return builder.Build();
    }
    catch (Exception e)
    {
        throw new RuntimeException(e);
    }
}

RestSharp 调用代码 #

try
{
    System.Net.ServicePointManager.ServerCertificateValidationCallback += (sender, cert, chain, sslPolicyErrors) =>
    {
        return true;
    };
    ServicePointManager.SecurityProtocol = SecurityProtocolType.Ssl3 | SecurityProtocolType.Tls12 | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls;

    string userAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36";

    var client = new RestClient(url);
    client.UserAgent = userAgent;
    var request = new RestRequest(Method.POST);
    request.RequestFormat = DataFormat.Json;
    request.AddHeader("cache-control", "no-cache");
    request.AddHeader("X-Requested-With", "XMLHttpRequest");
    request.AddHeader("Referer", "");

    request.AddJsonBody(param);
    var response = await client.ExecuteTaskAsync(request);

    return response.Content;
}
catch (Exception ex)
{
    string err = ex.Message;
    return err;
}

可能的失败原因 #

• User-Agent版本差异：OkHttp使用的是Chrome 96版本的UA，RestSharp用的是Chrome 120版本，Cloudflare的Bot检测规则可能对UA版本有校验，版本跨度太大被判定为异常请求。
• 请求头不匹配：
  • OkHttp手动添加了Connection: keep-alive和content-type: application/json，RestSharp不仅缺少Connection头，还额外添加了cache-control: no-cache和X-Requested-With: XMLHttpRequest，多余的请求头可能触发Cloudflare拦截规则。
  • RestSharp的AddJsonBody可能自动修改或覆盖content-type头，导致实际发送的Content-Type与OkHttp不一致。
• SSL/TLS握手逻辑差异：
  • OkHttp自定义了SSLContext并指定使用SSL协议，同时禁用了连接重试；RestSharp则开启了多种协议（SSL3、TLS1.0/1.1/1.2），默认可能保留重试机制，握手时的协议版本、加密套件以及重试行为都可能被Cloudflare识别为异常。
• 请求体格式差异：
  • OkHttp将postdata以binary类型直接发送，RestSharp的AddJsonBody会自动序列化对象为JSON，序列化后的字段顺序、空格、换行符等格式可能与OkHttp发送的内容不一致，Cloudflare可能对请求体的哈希或结构做了校验。
• 同步/异步请求特征差异：OkHttp用同步方式发送请求，RestSharp用异步方式，底层连接池、请求时序的差异可能被Cloudflare的行为检测规则捕捉到。

内容的提问来源于stack exchange，提问作者seopower