Spring Boot通过Cloudflare访问S3图片遇403/301错误求解决

问题根源 #

1. 403/401错误：Cloudflare的机器人检测机制拦截了Java默认请求，原因是请求缺少浏览器级别的请求头（如User-Agent、Accept），被判定为非合法客户端。
2. 301错误：RestTemplate默认不自动处理重定向，而Cloudflare通常会将HTTP请求重定向到HTTPS，或进行域名跳转。

针对301错误的RestTemplate优化 #

配置RestTemplate自动跟随重定向，并补充完整请求头：

// 开启自动重定向
SimpleClientHttpRequestFactory factory = new SimpleClientHttpRequestFactory();
factory.setFollowRedirects(true);
RestTemplate restTemplate = new RestTemplate(factory);

HttpHeaders headers = new HttpHeaders();
headers.set("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36");
headers.set("Accept", "image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8");
HttpEntity<String> entity = new HttpEntity<>(headers);

byte[] imageData = restTemplate.exchange(imageUrl, HttpMethod.GET, entity, byte[].class).getBody();

针对403/401错误的URLConnection优化 #

给URLConnection添加浏览器请求头并开启重定向：

URL url = new URL(logoPath);
HttpURLConnection connection = (HttpURLConnection) url.openConnection();

// 模拟浏览器请求头
connection.setRequestProperty("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36");
connection.setRequestProperty("Accept", "image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8");
// 自动跟随重定向
connection.setInstanceFollowRedirects(true);

InputStream inputStream = connection.getInputStream();
FileOutputStream outputStream = new FileOutputStream("image.png");
byte[] buffer = new byte[1024];
int bytesRead;
while ((bytesRead = inputStream.read(buffer)) != -1) {
    outputStream.write(buffer, 0, bytesRead);
}
inputStream.close();
outputStream.close();

针对Image.getInstance的优化 #

由于Image.getInstance底层依赖URLConnection，需先手动配置请求头获取流，再转为Image：

URL url = new URL(imageUrl);
HttpURLConnection connection = (HttpURLConnection) url.openConnection();
connection.setRequestProperty("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36");
connection.setRequestProperty("Accept", "image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8");
connection.setInstanceFollowRedirects(true);

InputStream inputStream = connection.getInputStream();
Image image = Image.getInstance(inputStream);
inputStream.close();

额外排查点 #

如果上述方案仍无效，检查以下内容：

• Cloudflare控制台的WAF规则：是否限制了Spring Boot服务器的IP，需将该IP加入白名单。
• Referer校验：若Cloudflare设置了Referer白名单，需在请求头中添加Referer字段，值为允许的域名。

内容的提问来源于stack exchange，提问作者AasthaChaudhary