[Bug] urllib denied by Cloudflare

[alukach]

Description of Bug:

Cloudflare rejects the urllib user agent.

Steps to Reproduce:

▶ curl -H "User-Agent: Python-urllib/3.6" https://data.source.coop/fused/overture/README.md --verbose 2>&1 | grep "< HTTP/2"
< HTTP/2 403

▶ curl -H "User-Agent: Mozilla/5.0" https://data.source.coop/fused/overture/README.md --verbose 2>&1 | grep "< HTTP/2"
< HTTP/2 200

Expected Behavior:

Requests work as expected.

Actual Behavior:

User receives a 403.

Screenshots:

Additional Context:

[saulbert]

Confirming we hit this too from a Python catalog-building pipeline.
A few details that might help triage:

• The response body is literally error code: 1010 — that's
  Cloudflare's Bot Management / Browser Integrity Check denial code,
  so the rule lives at the CDN edge rather than in the Worker.
• It fires purely on the UA string: User-Agent: Python-urllib/3.13
  → 403, but User-Agent: (empty) → 200. So real abusive scrapers
  that omit or spoof a UA aren't caught either.
• urllib.request is the Python stdlib HTTP client and sends exactly
  Python-urllib/X.Y by default. So this silently 403s anything
  built on stdlib — quickstart tutorials, library fallbacks, etc. —
  without any indication in the response that the UA is the problem.

Easy workaround on our end (set a custom UA), but worth noting that
the audience most likely to hit this is also Source Coop's intended
audience (researchers / data scientists writing stock-Python access
scripts).

[this message written by Claude Opus 4.7 and approved by @saulpw]