Jerry your Cloudflare is getting in the way. When I go to feddit.online and run this JS in my browser dev tools I get a 403 and a bunch of gibberish from Cloudflare in my console:

fetch('/api/alpha/user/login', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    username: 'testuser',
    password: 'secretpassword'
  })
})
  .then(response => response.text())
  .then(text => {
    console.log('Raw response:', text);
    try {
      const json = JSON.parse(text);
      console.log('Parsed JSON:', json);
    } catch (err) {
      console.error('Failed to parse JSON:', err);
    }
  })
  .catch(error => console.error('Fetch error:', error));

<div class="cf-section cf-wrapper">
        <div class="cf-columns two">
          <div class="cf-column">
            <h2 data-translate="blocked_why_headline">Why have I been blocked?</h2>

            <p data-translate="blocked_why_detail">This website is using a security service to protect itself from online attacks. The action you just performed triggered the security solution. There are several actions that could trigger this block including submitting a certain word or phrase, a SQL command or malformed data.</p>
          </div>

          <div class="cf-column">
            <h2 data-translate="blocked_resolve_headline">What can I do to resolve this?</h2>

            <p data-translate="blocked_resolve_detail">You can email the site owner to let them know you were blocked. Please include what you were doing when this page came up and the Cloudflare Ray ID found at the bottom of this page.</p>
          </div>
        </div>
      </div><!-- /.section -->

Thanks for checking!

I was actually testing an invalid login, where it says “connection error” instead of “invalid login credentials” because the backend error isn’t sent due to a CORS issue.

After attempting login with piefed.social vs feddit.online, here’s the screenshots. See the “CORS missing origin” error under trasnferred column for feddit.online. Also the lack of access-control-allow-* headers compared to piefed.social.