[CHIA-4412] [Bug] NFT IPFS gateway: dweb.link returns 403 to Electron, nftstorage.link URLs bypass gateway setting

[danieljperry]

What happened?

This is related to issue #3058.

Found during 2.7.4 RC testing of GUI PRs #3060, #3061, #3062, #3063 (NFT media pipeline).

Two related issues with IPFS-hosted NFT content:

Custom IPFS gateway (PR #3061) is correctly read from prefs and used to translate ipfs:// URIs, but dweb.link (and likely other Cloudflare-fronted gateways) returns HTTP 403 to Electron net.request. Likely Cloudflare bot detection rejecting non-browser User-Agent. The same URLs return 200 via curl. Fix: set a browser-like User-Agent header on gateway requests, or document which gateways work with Electron.

NFTs minted with nftstorage.link as the primary HTTPS data URI (e.g. https://nftstorage.link/ipfs/bafybei.../file.png) are permanently broken. nftstorage.link now 302-redirects to ipfs.io, which returns 429 (rate limit, sunsetting Sept 21 2026). The custom gateway setting only affects ipfs:// scheme URIs, not plain HTTPS URLs. These NFTs have no working data URI unless the GUI can detect IPFS paths inside HTTPS gateway URLs and re-route them through the user-configured gateway.

Test NFT: launcher ID 11ee129f76894c8a8e07c728207b1f14495b74d3edbacb20e1d16beeb971be66 (BatGAN POAP Miami #12)

Data URIs: https://nftstorage.link/ipfs/bafybeiep45.../BatGAN_POAP_Miami_12.png and ipfs://bafybeiep45.../BatGAN_POAP_Miami_12.png

Content verified correct (sha256 matches on-chain data_hash) via direct curl.

Version

2.7.4 RC2+

What platform are you using?

Linux

What ui mode are you using?

GUI

Relevant log output or stacktrace

[danieljperry]

@jlobue10 I did some testing with all four of your new PRs. I think these are good updates, but I'm finding that none of the major IPFS gateways will load some of my NFTs. This bug describes two of the reasons behind this. Maybe you could suggest a new Gateway in the GUI which will work with Electron. I'm inclined to accept your other four PRs because I think they improve the chances that these NFTs will load, but the situation is not perfect.

All of that said, we understood why links would break, which is why we allow users to add new links, but it might still be possible to rescue some of these NFTs without this extra step.

[jlobue10]

Thanks for the testing. Both points are real, and #3066 (stacked on #3061) addresses them. What I found:

403 from dweb.link and friends. It is Cloudflare bot management, and the trigger is the opposite of what one might guess: it challenges browser-like User-Agents. Electron identifies as Mozilla/5.0 … Chrome/150 … Electron/43, which Cloudflare treats as a browser that then fails to run the JavaScript challenge, so it gets the 403 page (cf-mitigated: challenge). Curl passes because it does not claim to be a browser. I reproduced it with Electron 43.4.0's own network stack: while dweb.link was challenging, the default and the GUI's real User-Agent got the 403 page and Chia-Blockchain-GUI/2.7.4 got the full file, same minute. #3066 sends that honest app User-Agent on NFT resource requests; with it, ipfs.io, dweb.link, w3s.link and nftstorage.link all served the BatGAN file today.

nftstorage.link links. #3066 also treats an https gateway link (host/ipfs/<CID>/… or <CID>.ipfs.host/…) as IPFS content: the on-chain link is tried first, and when its host fails the same CID path is fetched through the configured gateway under the same cache key and verified against the on-chain hash as before. Your BatGAN NFT resolves either way now.

Which gateway to suggest. The IPFS Foundation announced in August that ipfs.io and dweb.link are being rate limited for applications ("and will be increasing") and now send browsers to a service-worker gateway (https://blog.ipfs.tech/2026-08-beyond-sponsored-gateways/), so the ipfs.io default will keep degrading regardless of the User-Agent. In today's survey https://ipfs.mintgarden.io, https://gateway.pinata.cloud and https://ipfs.filebase.io served the file to Electron without any challenge. MintGarden is the natural choice for Chia NFTs (it pins most of them and is run inside the ecosystem); pinata and filebase fetch unpinned content from the network. #3066 names those in the settings text. Changing the shipped default from ipfs.io is a one-line change in util/ipfs.ts if you want it; I left that decision to you.

One caveat on "rescuing" NFTs: a good share of nft.storage-era CIDs are no longer pinned anywhere (ipfs.io itself returns 504 after a full DHT search, and pinata, filebase and mintgarden cannot find them). No gateway setting can bring those back; the fallback helps exactly the NFTs whose content still exists somewhere, like the BatGAN one.