From 00f0d2ba6a957a4848139dd74b21aac3839265e3 Mon Sep 17 00:00:00 2001
From: MasterDevYY <27541192+MasterDevYY@users.noreply.github.com>
Date: Sun, 8 Feb 2026 21:57:27 +0800
Subject: [PATCH 1/2] fix: resolve SSL and media retrieval issues - Fix
 CERTIFICATE_VERIFY_FAILED error on some Linux distributions. - Fix 403
 Forbidden error when fetching images and videos from origin servers.

---
 app/services/grok/services/assets.py | 5 ++++-
 app/services/grok/services/image.py  | 2 ++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/app/services/grok/services/assets.py b/app/services/grok/services/assets.py
index cfcf62a..3dbce50 100644
--- a/app/services/grok/services/assets.py
+++ b/app/services/grok/services/assets.py
@@ -155,10 +155,13 @@ class BaseService:
         """构建请求头"""
         if download:
             headers = {
-                "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+                "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
                 "Sec-Fetch-Dest": "document",
                 "Sec-Fetch-Mode": "navigate",
+                "Sec-Fetch-Site": "same-origin",
+                "Sec-Fetch-User": "?1",
                 "Referer": referer,
+                "User-Agent": self.config.user_agent,
             }
         else:
             headers = {
diff --git a/app/services/grok/services/image.py b/app/services/grok/services/image.py
index 089a5f0..573e1a2 100644
--- a/app/services/grok/services/image.py
+++ b/app/services/grok/services/image.py
@@ -3,6 +3,7 @@ Grok Imagine WebSocket image service.
 """
 
 import asyncio
+import certifi
 import json
 import re
 import ssl
@@ -30,6 +31,7 @@ class ImageService:
 
     def __init__(self):
         self._ssl_context = ssl.create_default_context()
+        self._ssl_context.load_verify_locations(certifi.where())
         self._url_pattern = re.compile(r"/images/([a-f0-9-]+)\.(png|jpg|jpeg)")
 
     def _resolve_proxy(self) -> tuple[aiohttp.BaseConnector, Optional[str]]:

From 8c791179c15d9ac5bd8620874baf99ddc4cc0704 Mon Sep 17 00:00:00 2001
From: MasterDevYY <27541192+MasterDevYY@users.noreply.github.com>
Date: Sun, 8 Feb 2026 23:36:22 +0800
Subject: [PATCH 2/2] fix: update assets.py Sec-Fetch-Site header to same-site

---
 app/services/grok/services/assets.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/services/grok/services/assets.py b/app/services/grok/services/assets.py
index 3dbce50..9197f85 100644
--- a/app/services/grok/services/assets.py
+++ b/app/services/grok/services/assets.py
@@ -158,7 +158,7 @@ class BaseService:
                 "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
                 "Sec-Fetch-Dest": "document",
                 "Sec-Fetch-Mode": "navigate",
-                "Sec-Fetch-Site": "same-origin",
+                "Sec-Fetch-Site": "same-site",
                 "Sec-Fetch-User": "?1",
                 "Referer": referer,
                 "User-Agent": self.config.user_agent,