Solve Cloudflare challenges of non-GET requests on the site's root

Closes #3909

CHANGELOG.md

@@ -39,6 +39,7 @@ The format is a modified version of [Keep a Changelog](https://keepachangelog.co
 - Fix long floating point numbers showing up in Comick progress ([@MajorTanya](https://github.com/MajorTanya)) ([#4090](https://github.com/mihonapp/mihon/pull/4090))
 - Fixed updating from v0.20.x failing when the database had duplicate history or tracking entries, or damaged indexes ([@AntsyLich](https://github.com/AntsyLich))
 - Fixed a crash when a back gesture was still in progress as the reader or a dialog closed ([@AntsyLich](https://github.com/AntsyLich))
+- Fixed Kitsu login and other requests that send data failing with "Failed to bypass Cloudflare" ([@AntsyLich](https://github.com/AntsyLich))
 
 ## [v0.21.1] - 2026-10-12
 ### Fixed

core/common/src/main/kotlin/eu/kanade/tachiyomi/network/interceptor/CloudflareInterceptor.kt

@@ -79,6 +79,14 @@ class CloudflareInterceptor(
         var isRenderProcessGone = false
 
         val origRequestUrl = originalRequest.url.toString()
+        // A WebView can only load a page with GET, and loading the url of another method usually reaches an
+        // endpoint that answers GET without a challenge to solve. The clearance covers the whole site, so it's
+        // earned on the site's root page instead.
+        val challengeUrl = if (originalRequest.method == "GET") {
+            origRequestUrl
+        } else {
+            originalRequest.url.newBuilder().encodedPath("/").query(null).fragment(null).build().toString()
+        }
         val headers = parseHeaders(originalRequest.headers)
 
         executor.execute {
@@ -109,7 +117,7 @@ class CloudflareInterceptor(
                         latch.countDown()
                     }
 
-                    if (url == origRequestUrl) {
+                    if (url == challengeUrl) {
                         if (!challengeFound) {
                             // The first request didn't return the challenge, abort.
                             latch.countDown()
@@ -157,7 +165,7 @@ class CloudflareInterceptor(
                 }
             }
 
-            webview.loadUrl(origRequestUrl, headers)
+            webview.loadUrl(challengeUrl, headers)
         }
 
         latch.awaitFor30Seconds()