This is unrelated to cdnjs, which shouldn't do that, it "should" just be dumb static hosting with security off. But yes, it absolutely does this for sub resour

This is unrelated to cdnjs, which shouldn't do that, it "should" just be dumb static hosting with security off. But yes, it absolutely does this for sub resources on a CF hosted site. If you <img src> an image it's entirely likely that the image doesn't load if you pass one CF check and fail another. Why would it? You want people to bypass L7 filters by simply adding a fake referrer or header?