Reverse Proxying Notion API via Nginx Triggers Cloudflare 403 and 421 Errors

Other Questions Notion
1

When using Notion API with Nginx reverse proxy, Cloudflare returns 403/421 errors. Vite proxy works; alternative SSL tweaks have failed. How can I resolve this?

// Example Vite proxy configuration
const proxyRoutes = {
  '/notionQuery': {
    target: `https://api.alt-notion.com/v1/lists/${process.env.NOTION_LIST_ID}`,
    changeOrigin: true,
    rewritePath: (route) => route.replace(/^\/notionQuery/, ''),
    headers: {
      Authorization: `Bearer ${process.env.API_TOKEN}`,
      'Notion-Version': '2022-07-01'
    }
  }
};

# Example Nginx configuration
location /notionQuery {
    proxy_ssl on;
    proxy_ssl_name $upstream_host;
    rewrite ^/notionQuery(.*)$ /v1/lists/ALT_NOTION_ID$1 break;
    proxy_pass https://api.alt-notion.com;
}
2

I was struggling with a similar issue when trying to integrate a custom reverse proxy. In my case, reviewing your rewrite and ssl-related directives in the Nginx config helped. I noticed that sometimes the problem lies in how Cloudflare expects the TLS handshake to be configured. After some tinkering, I had to ensure that the server’s TLS version and compatible ciphers were explicitly set in Nginx settings to meet Cloudflare’s requirements. Double-checking these SSL details resolved my errors, so it might be worthwhile to verify your configuration.

3

I encountered a similar problem when trying to reverse proxy for a third-party API that strictly enforced TLS and header configurations. In my case, ensuring that the Host header was passed exactly as expected by the API helped resolve the issue. I also noticed that tweaking some of the proxy parameters, such as explicitly setting proxy_set_header and disabling HTTP/2 when necessary, produced more consistent behavior. It appears that strict header match and handshake requirements enforced by Cloudflare might be the underlying trigger for the 403 and 421 responses.

4

hey, try setting proxy_set_header host to match the actual domain, and drop http2 sometimes. i had similar hiccups when cloudflare didnt like the sni mismatch in tls settings, so double-check those configs.