[BUG] RSO Cloudflare 1020

[geozukunft]

I am writing this issue on behalf of multiple other people.
Bug Description
It is not possible to use RSO as Cloudflare is responding with error code 1020 for requests going to auth.riotgames.com from some IaaS providers.

Problem Description
It seems like multiple cloud providers are getting Access Denided responses from Cloudflare a list of the providers is below:

• OVHcloud AS16276
• DigitalOcean
• Hetzner US AS23795 / 25762

Expected Result
Be able to reach auth.riotgames.com to be able to use RSO

Actual Result
Access Denied by Cloudflare with error code 1020

Developer Impact
Developers that host their infrastructure on one of the affected providers are unable to use RSO to verify users.
Developers are also unable to check if they still have permission from the specific user or if the user revoked their permission this can lead to GDPR related issues for developers as well.

• Frequency: Every API call.
• Severity: No verification of users possible

Player Impact
This affects players of all games where RSO is used to verify users especially Legends of Runterra and Valorant where RSO provides additonal API functions / is mandatory for some tasks.

• Frequency: New players are unable to sign up and already connected players are unable to make sure that the developer of a website no displays their data (in Valorant) when they revoked the permission.
• Severity: New users are unable to join the website and reacurring users cannot relogin.
• Quantity: We are unable to say exactly how many players are affected by this issue but considering the size of the already knowingly affected cloud providers chances of a non insignificant amount of players being affected is high.
• Region: This issue is global

Preconditions

• Have access to an RSO enabled application

Repro Steps

1. Send a POST request to auth.riotgames.com/token

Issue Comments
This issue was first mentioned on the 3rd party community developer server on February 25th 2023

Labels
api: rso
scope: riot
scope: lol
scope: lor
scope: val
scope: tft
type: bug report
topic: underlying service

[bangingheads]

This originally happened with issue #650 but it was resolved but is happening again.

[Grommise]

Also receiving this issue. We first recorded it on March 8 and haven't been able to find a solution.

[Vidalee]

Just for the record, here is the time it started to fail for me: Fri, 24 Feb 2023 22:27:39 GMT.

[riotstillrampant]

Hey all, Cloudflare (and Riot) worked to get a fix for this over the past couple weeks, should be live now, let us know if you still see these issues or if they're resolved.

[iaace-NA]

Fixed for me

[Vidalee]

Everything is fine on our side now. Thank you for resolving this issue, although more communication would have been appreciated.

[geozukunft]

I'll close this issue for now then and in case that it happens again people should just open up a new one anyway

[edthepurple]

Hello. is this issue supposed to be resolved by now? auth.riotgames.com is unaccessible from OVHCloud.

[Vidalee]

Hello. is this issue supposed to be resolved by now? auth.riotgames.com is unaccessible from OVHCloud.

No issues currently from my OVH server.

[edthepurple]

Hello. is this issue supposed to be resolved by now? auth.riotgames.com is unaccessible from OVHCloud.

No issues currently from my OVH server.

My server's IPv4 being in this subnet 51.195.148.0/22 is indeed blocked.