41Baloo / balooProxy

Lightweight http anti-ddos reverse-proxy made in golang
GNU General Public License v3.0
149 stars 35 forks source link

Balooproxy whitelist firewall rules aren't taking effect #57

Open 666wCodes opened 1 week ago

666wCodes commented 1 week ago

For example, I made a firewall rule that whitelists requests that contain "/api" in the request path.

{ "expression": "(http.path contains \"/api\")", "action": "0" },

Which should whitelist requests, however it only whitelists some requests, such as requests from a normal browser, however requests from an http client (such as axios or go http client) is blocked as baloo detects a headless browser:

"Blocked by BalooProxy. Your browser Headless Browser is not allowed."

BalooProxy should allow all requests whether it is from a Headless Browser or not as it is explicitly defined in the firewall rule to whitelist requests

I tried refining the firewall rule by adding whitelist to unknown browsers and the ip address i sent the requests from

{ "expression": "(ip.src eq \"IPADDRESS\" or ip.engine eq \"\" and http.path contains \"/api\")", "action": "0" }

Yet still no luck, this makes it difficult for Balooproxy to protect dynamic sites that have APIs.

41Baloo commented 5 days ago

Custom rules are per-design only evaluated after the fingerprint blocking. I will try to remove the falseflag from axios and go tho