Skip to content

Fix 403 errors when downloading metadata from Packagist and GitHub (ReactDownloader headers issue) #709

Description

@pejman-hkh

While using Repman as a proxy, we are encountering 403 Forbidden errors when downloading package files and metadata.

The issue appears to be related to missing or incorrect HTTP headers in ReactDownloader.php.


Problem Details

  1. Packagist returns 403 when the Repman header is sent.
  2. GitHub returns 403 when no User-Agent header is provided.

Currently, the stream context does not properly adjust headers depending on the target host.


Suggested Improvement

It would be better to conditionally set headers based on the request URL.

Example:

private function createContext(array $headers = [], string $url = '')
{
    if ($url && str_contains($url, 'github.com')) {
        $headers[] = 'User-Agent: MyApp';
    }

    $context = [
        'http' => [
            'header' => implode("\r\n", $headers),
            'follow_location' => 1,
            'max_redirects' => 20,
        ],
    ];

    return stream_context_create($context);
}

This approach:

  • Ensures a valid User-Agent header for GitHub requests
  • Avoids problematic headers when requesting from Packagist
  • Prevents 403 errors during metadata and package downloads

Why This Matters

Without proper header handling:

  • GitHub blocks requests without User-Agent
  • Packagist may block requests with certain custom headers
  • Metadata downloads and dependency resolution can fail

If needed, I can prepare a pull request implementing this change.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions