From e5195b2613a17fd7019752189c2976330743de6d Mon Sep 17 00:00:00 2001 From: James Woglom Date: Tue, 30 Jun 2026 22:56:26 +0000 Subject: [PATCH] Fix WAF 403 by sending same-origin Origin/Referer to Source API api_headers() hardcoded Origin/Referer to tconnect.tandemdiabetes.com, but requests target SOURCE_URL (source.tandemdiabetes.com / source.eu.tandemdiabetes.com). The WAF enforces same-origin and returned HTTP 403 ("The request is blocked"). Derive Origin/Referer from SOURCE_URL so both US and EU regions match. --- tconnectsync/api/tandemsource.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/tconnectsync/api/tandemsource.py b/tconnectsync/api/tandemsource.py index d446261..7c9e654 100644 --- a/tconnectsync/api/tandemsource.py +++ b/tconnectsync/api/tandemsource.py @@ -365,8 +365,11 @@ class TandemSourceApi: raise Exception('No access token provided') return { 'Authorization': 'Bearer %s' % self.accessToken, - 'Origin': 'https://tconnect.tandemdiabetes.com', - 'Referer': 'https://tconnect.tandemdiabetes.com/', + # The WAF enforces same-origin: Origin/Referer must match SOURCE_URL + # (source.tandemdiabetes.com / source.eu.tandemdiabetes.com), otherwise + # it returns HTTP 403 ("The request is blocked"). + 'Origin': self.SOURCE_URL.rstrip('/'), + 'Referer': self.SOURCE_URL, **base_headers() }