Cloudflare / DDoS mitigation is done incorrectly

Summary

Here is an example of what I just traced through for installing meshpack plugin in my unreal engine…

DNS and TCP/443 are healthy for www.fab.com, api.epicgames.dev, cdn.quixel.com, Akamai, CloudFront, and Fastly. The
CDN download works: cdn.quixel.com/...FabLauncher_ue5.7...zip returns 200 OK.

The failing endpoint is still:

https://www.fab.com/e/artifacts/MeshPack8fbfed5e86b8V7/manifest

It returns 403 Forbidden from Cloudflare, and the Launcher logs show the same Cloudflare “security check” HTML page
being returned where Fab expects manifest data. That causes MD-0011-0 / IS-EO-Lnc-BldInfo:Http-403 and empty Fab
download fields.

When you’re using non interactive endpoints you cannot use an interactive mitigation process like what cloudflare injects or the service will just not work. This completely breaks the ability to use your applications.

What type of bug are you experiencing?

Plugins

URL where the bug was encountered

https://www.fab.com/e/artifacts/MeshPack8fbfed5e86b8V7/manifest

Steps to Reproduce

Fresh install of apps or plugins may trigger cloud flare to show human validation in which case it fails due to the fact that there is no human in the loop…

Expected Result

Retrieve manifests directly from a non interactive location so fab can install them. Ideally set a session to the current authenticated fab client which bypasses cloudflare.

Observed Result

Breaking change… cannot install required plugins.

Platform

Fab install to engine && Epic games → Library → Install to engine… both fail.

Operating System

Windows 11 Pro

Upload an image

Good repro. I hope they get this sorted!

PS: Have you tested installed it through the Fab browser in editor? I’ve seen some reports that it is more reliaable.
PS2: Feel free to send me a DM Discord if you can’t get it installed through the launcher.