Project: tess-vercel-api
Plan: Hobby
Issue started suddenly without code changes or redeploy.
Symptoms:
-
Production API requests now fail with browser CORS errors, but actual response is:
-
HTTP 403 Forbidden
-
X-Vercel-Mitigated: challenge
-
Content-Type: text/html
-
-
Direct API request to:
https://tess-vercel-api.vercel.app/api/tessapp-apx?action=organisationAdminPortalGetOrganisation
returns Vercel challenge instead of reaching server. -
vercel dev also fails during setup with:
Error: invalid json response body at https://vercel.com/.well-known/openid-configuration reason: Unexpected token ‘<’, "<!DOCTYPE "… is not valid JSON
Diagnostics:
-
Browser opening https://vercel.com/.well-known/openid-configuration returns JSON
-
Node fetch / curl returns:
-
403 Forbidden
-
X-Vercel-Mitigated: challenge
-
-
Bot Protection is inactive
-
No custom firewall rules originally
-
Added bypass rule for /api/tessapp-apx, but issue persists
-
Firewall dashboard shows DDoS Mitigation challenges
This appears to be a false positive from Vercel DDoS mitigation affecting both project traffic and CLI/OIDC requests.
Requesting review/unblock or guidance.