curl gets 403 from an Akamai-fronted site, the browser doesn't

The university's ICS export rejected curl until I sent a browser User-Agent.

2026-10-12

curl
http
akamai

The campus calendar export (export_execute.php?...&authtoken=...) answered plain curl with 403 Access Denied, while the same URL worked in the browser.

The CDN in front of it filters on the User-Agent header. Sending a normal Chrome UA is enough:

curl -sS -A "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0 Safari/537.36" \
  "$UNIR_ICS_URL" | head -1   # BEGIN:VCALENDAR

No need for curl-impersonate or a headless browser. Two things worth remembering:

Treat the URL as a secret: the token in it is a credential, valid until the account password changes.
Check that the body starts with BEGIN:VCALENDAR before trusting it; an error page can come back with a 200.