为什么cors-anywhere仅针对fibank.bg的特定地址返回错误信息

你遇到的错误是fibank的Web应用防火墙拦截了cors-anywhere转发的请求，页面提示的浏览器扩展问题只是对方返回的通用错误文案，实际触发拦截的原因如下：

• 请求头错误携带了Content-Type: application/json，访问普通HTML页面不需要该请求头，会被判定为非浏览器正常请求
• cors-anywhere默认转发时会自动添加X-Requested-With头，多数站点的反爬策略会直接拦截携带该头的请求
• 未模拟正常浏览器的UA、Accept等标准请求头，被WAF识别为爬虫请求直接拦截

1. 修改cors-anywhere服务的启动配置，移除异常头并模拟浏览器请求头：

// cors-anywhere服务启动文件调整
const cors_proxy = require('cors-anywhere');
cors_proxy.createServer({
  originWhitelist: [], // 可按需配置允许访问代理的前端源
  removeHeaders: ['x-requested-with', 'origin'],
  setHeaders: {
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36',
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8',
    'Accept-Language': 'en-US,en;q=0.5',
    'Accept-Encoding': 'gzip, deflate, br'
  }
}).listen(8080, '0.0.0.0');

2. 调整React项目中的fetch代码，删除不必要的请求头配置，同时修正state更新逻辑避免常量污染：

useEffect(() => {
  fetch(
    `http://localhost:8080/https://www.fibank.bg/en/currency-rates`
  )
  .then((response) => response.text())
  .then((result) => {
    if (result) {
      const el = document.createElement("html");
      el.innerHTML = result;
      const arr = Array.from(el.getElementsByTagName("tr"));
      const filtered = arr.filter((el) => {
        return CURRENCIES.includes(getCurrencyStr(el));
      });
      // 深拷贝常量避免原始值被污染
      const newCurrencyRates = JSON.parse(JSON.stringify(DEFAULT_CURRENCY));
      filtered.forEach((el) => {
        const currentCurrency = getCurrencyStr(el);
        if (currentCurrency && currentCurrency in newCurrencyRates) {
          newCurrencyRates[currentCurrency].buy = el.children[4].innerHTML;
          newCurrencyRates[currentCurrency].sell = el.children[5].innerHTML;
        }
      });
      setCurrencyRates(newCurrencyRates);
    } else {
      throw new Error("无有效返回内容");
    }
  })
  .catch((error) => console.log(error.message));
}, []);

内容的提问来源于stack exchange，提问作者retro