Title: Google Apps Script: 403 in simple UrlFetchApp.fetch
Tags: javascript,python-3.x,google-apps-script

Question: I have the following Python code that runs fine from my computer:
>>> from requests import get
>>> response = get("https://fiis.com.br/btal11/")
>>> response
<Response [403]>
>>> response = get("https://fiis.com.br/btal11/", headers={'User-agent': 'Mozilla/5.0'})
>>> response
<Response [200]>

If I simply add a user-agent header, I'm able to get the html page content. However, with the equivalent JS code on google Apps Script that doesn't work:
function GORDON(input) {
  var url = "https://fiis.com.br/btal11/";
  var options = {
    muteHttpExceptions: true,
    headers: {"User-agent": "Mozilla/5.0"},
  };
  var response = UrlFetchApp.fetch(url, options);
  console.log(response.getContentText());
  //var something = HtmlService.parse(response.getContentText());
}

and the result seems to be a challenge from Cloudflare to be solved:
<!DOCTYPE html>
<html lang="en-US">
<head>
    <title>Just a moment...</title>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
    <meta http-equiv="X-UA-Compatible" content="IE=Edge">
    <meta name="robots" content="noindex,nofollow">
    <meta name="viewport" content="width=device-width,initial-scale=1">
    <link href="/cdn-cgi/styles/challenges.css" rel="stylesheet">
    

</head>
<body class="no-js">
    <div class="main-wrapper" role="main">
    <div class="main-content">
        <h1 class="zone-name-title h1">
            <img class="heading-favicon" src="/favicon.ico" alt="Icon for fiis.com.br"
                 onerror="this.onerror=null;this.parentNode.removeChild(this)">
            fiis.com.br
        </h1>
        <h2 class="h2" id="challenge-running">
            Checking if the site connection is secure
        </h2>
        <noscript>
            <div id="challenge-error-title">
                <div class="h2">
                    <span class="icon-wrapper">
                        <div class="heading-icon warning-icon"></div>
                    </span>
                    <span id="challenge-error-text">
                        Enable JavaScript and cookies to continue
                    </span>
                </div>
            </div>
        </noscript>
        <div id="trk_jschal_js" style="display:none;background-image:url('/cdn-cgi/images/trace/managed/nojs/transparent.gif?ray=79c3f9c65b60e3b6')"></div>
        <div id="challenge-body-text" class="core-msg spacer">
            fiis.com.br needs to review the security of your connection before proceeding.
        </div>
        <form id="challenge-form" action="/btal11/?__cf_chl_f_tk=1lWKKYirqW.UmES1h5ANk6aNER4buUV9BvandjshiQU-1676861855-0-gaNycGzNCHs" method="POST" enctype="application/x-www-form-urlencoded">
            <input type="hidden" name="md" value="vA5q0MLK_A04uFcQqCyCa20MICLT.o_hZCm87QeOsEc-1676861855-0-Ab6XuJyj-1RtGxhMzcfJQ2E1vrHaAOzs987bM2ZpxqFwZvWYvUEnID4JOSO1iJLQDPqYPPzX-AwcdroRh5CKZ2UP4_o_uqOfOeYMVZJo1S4iqBZ3loTopwRBpVHtAADxvebnNBvP_HyStPDyJH0VkGGHwcBpjJsmv-duU8lhq7z9ex0TS-wNsyNhp4eoM23Uwzi30418XhWvNqoK66sEcrN6vaZW8EJEGFfxW2LDf-R9ZoYUay2xt4Xgcwz17nDgEWeGlR_L-S5RvonpDTBnk5ujbFc_hdwX7Y39NdeIDLTlTCtudzHHEsK0hhbZjHVL7xl4YwkgxKoLaL-URi59VSdHMNcxlHZNt65EWGwS_gXhXG7BFX74CI-EgVo-138F_E9KyWgWz2kL2C4RYG-fcRHEMsYUZznCznaRm4CipklQIGrg1TzLb8GmB25HhjZM-BgKMprLPWJ2jCJ_Yw5KxurVebXuzinZt43H_5klyYd3Of0TwBnTjVMmDbdWsQaQds7PWHi1qq7fXVATS9MzHzZiaY7VmLjdkMWizlMIAmBafYqltGgh8dEZy3sPom6zbj38YGuOxF6gJWrx1tBGm_Kdm15E3gZqgKpmyRuXPDb-a6m0ncJK41sn6XUxUxM-2QuvV1OyAylzTyVderxsqKGH1VJlHcRVUxVyAldAgzMT4SHhH3kcN0CF3cPH9bj1yrw29rXel4ZKowdCYfzRgVJJxdmaz6MTqeEdoj9eXk9h_hfOS1xYImhsCKD1r7SFsmNx2-awD3il9esnD-OR7NwuUg9CruUOBeOnUUgZEg88_l_-B5TYEHARh9Vecg6KVru0XxlaZU2x42gE8vfiKcUKWbNykHFgXFYSwwqwc6zLtF_1UVi76EA0RTX0dITNU-dyXbSRn7HUT8UJojrc5uohnsO5u1smAz9JH7cGJGiZABVaVyKxVIfVQRIPXkbfndrUY_9M5TS0Ms6LLYfozjEGVbC6SegE-FzQEGvJeTHrQz2nA4PM_m3by4L283EJDHk3jnd23_CpM6coZrQxLlyrpAxOzi3lx91cppJONKQd0QMJNaTY6j5URnx2uO8Uto1tbeXZ3lKKheIuYfxBECzuALkPqNqB3pbdm3H6TXPSrpBmqWHPB7yqSowbkQN5qHFePDdg6DBuH40Hm4NgONvkVMmD_D4r8HyJ58-GK4gDF_bmWJjgyLB5pMsxCcGZm50u9bS7f-eHDMyGTYdhlOzU6tnJs3-B54m2ph65RNPgkYqg3TDFDHc1GDM61vhxj2QFAJY_crvxYhd6mAr1C--fk38rs1f_LX42Uqt1rcZCEZXr5eHFivIuAmDlSl-8iz0C8Y2K9M0fUS-fid6dcYuK5BHWb9FTJ5lNWkRfEWIXyV-YhWdWkB85_NbPnPOOgDiNzPlCEzUN-AkzUFjFhEIu1k6goZUQXXujthhQta0NTG0T0B4aD3DB-k5ihYILF_w6vDhAZcAFz-TcR4t_TuvoHkGnlwwC354-1Hcb0IPdcrZIXb_8_PpIKRSHQeCErlzLYJfg0ZUobNbSVC6b6p15uXzITqX5FCoTIGNUWuWqiCYLBvcWcTBbAevpxQDLDrQfM351ZQUrcT5aeET6SeWLZftKhAZeHdiAc8KK_iw6jUpxrB4v2oGZAlU372wBIEZ0eQYQhMwJnm-PMODd3BodqE5HJe0Sc7wnUyjTT3Rxwv06Luv0-8CfswblPIYq7Mwx771ZXXPZmQyrepQ1-bBntEsvFgGI4jyPu8RKHuq8H8kdtLsj_t747dkdRq9zmXGIcCcTh09Vj-sTKHZPIHh396ljgzlVJ7k_nWX8BCHibRj3kUtnDhJarkzlobqb985ZNSybspZKlbG8f3qIWdo1wa1-Bo002tNWyElRcDt_xwXuneDTyP0qQWyX-7kKXlJFIYQ9detREaifPI1hA8fU11U2r2XzEsOLpxao18T9D9DjkvC4cGh6BsE3s8uyW06_Q5QhxvsADyW7HkZ6I72H_l6zObf9N3uKYfEy8CrcdMsS7eLXaLvxbzuNd2WuxbKu3N8AiI9D51lU8CEnSKCQa4SUzRj4f2q62HjhiG9HpT9TYRdyYPMsbb_eXUxvrA">
        </form>
    </div>
</div>
<script>
    (function(){
        window._cf_chl_opt={
            cvId: '2',
            cZone: 'fiis.com.br',
            cType: 'managed',
            cNounce: '97809',
            cRay: '79c3f9c65b60e3b6',
            cHash: 'fc3e1644bceb435',
            cUPMDTk: "\/btal11\/?__cf_chl_tk=1lWKKYirqW.UmES1h5ANk6aNER4buUV9BvandjshiQU-1676861855-0-gaNycGzNCHs",
            cFPWv: 'g',
            cTTimeMs: '1000',
            cMTimeMs: '0',
            cTplV: 4,
            cTplB: 'cf',
            cRq: {
                ru: 'aHR0cHM6Ly9maWlzLmNvbS5ici9idGFsMTEv',
                ra: 'TW96aWxsYS81LjAgKGNvbXBhdGlibGU7IEdvb2dsZS1BcHBzLVNjcmlwdDsgYmVhbnNlcnZlcjsgK2h0dHBzOi8vc2NyaXB0Lmdvb2dsZS5jb207IGlkOiBVQUVtZERkOHNNRzFSb0FJWGZTYnlsa2plUGwxdjhTdngwVUkp',
                rm: 'R0VU',
                d: 'K2hEeoWYs+sA9kntZPKxHqEaDzXqO9jP1DXfNo8U00z/HdqgsrqXN1eO/1L4D71PU/RaZfZMK/nfRS9wUs9n9wMZ7wa2+UCd+Wic1OqU3YV80fLAAQsnSPU7ZuJ5idh4DYvRqokv5w973lQ8O4+o5G9Tbp0TBj/G5oIVqE/HYaiQanIiyLhY6VoYkembTfL7ZFiePykhL/QWb9TRxI33+Iu8NCbRIfz5XQkDBoB0Lc2qftAyKY4kx40y7jiPLq1rOKk3be6zPJqXtYgbm0NE+2KuTRVy2gz9TN8LuBwy7sMi/uXEWXEh/8KDOUydo6rFxZ2ykmOVAhR6DiOj1CUBJvL71x01tHQLf0RBCbvrJ37who7mAkd8vNIQ3bBySUOeNTxVCxSDe1Erkx7EJjPzlmTDC9Ec9dyXddjMFV29k8B/8tTEOGtrNgsUenIOLd862lYHsqQTRdpGgQrdvgPxy/OOIBf93fM5A8CLogbDNLqYnVn8p0K8wvkk9Xjh9zc5mB3yR3KS0G/wz2S4BsLQEUb73vTj4fUDPK/QhxI3t4mWAk6kla2A7taIRA1myCoMbsQamtmqHB1396m+aubITHLeswV50zQ5si/qTqGlGSo+N5FYfBnUt96W/Cidhsxj76xDvYRC2GYaKJanN1h1IZnFb2B2Y4lfP0vkdy/qF6bp7upA1rMZ7ilLOu8LuOjb',
                t: 'MTY3Njg2MTg1NS43MzUwMDA=',
                m: 'SOz4uar/pXrmGBuSQIbY9tjFx2G6zirpJv2NyzOPmIM=',
                i1: 'cIUbIpvI2YsvZRb//Yfdfw==',
                i2: 'oC3KkuH26ng8Gt/f/kKHDw==',
                zh: 'wcWWf/+obaYUptPh30e4072sXWiLjlPsWQnQS/2QxMI=',
                uh: 'bllaG+Wp51WdmfI9k7pslxqw3F1/Neha3nrwdAjxueE=',
                hh: '+MXXTc/rARCfTxK8igcq3MtDXAltL4ou2PYE97G16x4=',
            }
        };
        var trkjs = document.createElement('img');
        trkjs.setAttribute('src', '/cdn-cgi/images/trace/managed/js/transparent.gif?ray=79c3f9c65b60e3b6');
        trkjs.setAttribute('alt', '');
        trkjs.setAttribute('style', 'display: none');
        document.body.appendChild(trkjs);
        var cpo = document.createElement('script');
        cpo.src = '/cdn-cgi/challenge-platform/h/g/orchestrate/managed/v1?ray=79c3f9c65b60e3b6';
        window._cf_chl_opt.cOgUHash = location.hash === '' && location.href.indexOf('#') !== -1 ? '#' : location.hash;
        window._cf_chl_opt.cOgUQuery = location.search === '' && location.href.slice(0, location.href.length - window._cf_chl_opt.cOgUHash.length).indexOf('?') !== -1 ? '?' : location.search;
        if (window.history && window.history.replaceState) {
            var ogU = location.pathname + window._cf_chl_opt.cOgUQuery + window._cf_chl_opt.cOgUHash;
            history.replaceState(null, null, "\/btal11\/?__cf_chl_rt_tk=1lWKKYirqW.UmES1h5ANk6aNER4buUV9BvandjshiQU-1676861855-0-gaNycGzNCHs" + window._cf_chl_opt.cOgUHash);
            cpo.onload = function() {
                history.replaceState(null, null, ogU);
            };
        }
        document.getElementsByTagName('head')[0].appendChild(cpo);
    }());
</script>


    <div class="footer" role="contentinfo">
        <div class="footer-inner">
            <div class="clearfix diagnostic-wrapper">
                <div class="ray-id">Ray ID: <code>79c3f9c65b60e3b6</code></div>
            </div>
            <div class="text-center" id="footer-text">Performance &amp; security by <a rel="noopener noreferrer" href="https://www.cloudflare.com?utm_source=challenge&utm_campaign=m" target="_blank">Cloudflare</a></div>
        </div>
    </div>
</body>
</html>

What am I missing over here? Is there any way to bypass this challenge?

Answer: With the help of @Tanaike, discovered that unfortunately Google appends junk info on user-agent header, which ends up being blocked by cloudflare. Doesn't seem to have a simple solution for now.