search

hslatman / caddy-crowdsec-bouncer

A Caddy module that blocks malicious traffic based on decisions made by CrowdSec.
126 stars 4 forks source link

[Feature] AppSec Integration #37

Open LaurenceJJones opened 5 months ago

LaurenceJJones commented 5 months ago

Hey @hslatman 👋🏻 We at CrowdSec have been working on a WAF component called AppSec, and whilst the component is within our preview stage, we would like to reach out to other web server bouncers to ask about a potential integration. (We would be willing to do the pull requests itself)

The first thing is to ask would you be interested in having this within this bouncer? or would you like this bouncer to solely handle just the IP checks?

Thank you for supporting our community with your bouncer!

hslatman commented 5 months ago

Hey @LaurenceJJones, thank you for reaching out 😄

I've seen some of the announcements about the new component, and am definitely interested in checking it out. I haven't had time to watch the webinar about it, but I hope I can do that soon. Exciting stuff 😄

At the moment I think it definitely makes sense to explore the option for adding it to this repo. I'd say it depends a bit on the scope of the new component, and if it can be made to fit in with the current way the bouncer integrates with Caddy. If that doesn't work out, I already have an alternative approach that isn't that far off.

Can you point me to some authoritative docs on the appsec component? Or currently limited to the webinar?

LaurenceJJones commented 5 months ago

Hey @LaurenceJJones, thank you for reaching out 😄

I've seen some of the announcements about the new component, and am definitely interested in checking it out. I haven't had time to watch the webinar about it, but I hope I can do that soon. Exciting stuff 😄

At the moment I think it definitely makes sense to explore the option for adding it to this repo. I'd say it depends a bit on the scope of the new component, and if it can be made to fit in with the current way the bouncer integrates with Caddy. If that doesn't work out, I already have an alternative approach that isn't that far off.

Can you point me to some authoritative docs on the appsec component? Or currently limited to the webinar?

So in short you forward a copy of the request to the configured AppSec port (same as bouncer its a http server) You need to add some variables to the request before it is sent

https://docs.crowdsec.net/docs/next/appsec/protocol

If something isn't clean from the documentation let me know, be glad to arrange a call or something 👍🏻

hslatman commented 5 months ago

Quick update on the matter: I have a basic version, but I'm tinkering with / thinking about the options and what makes most sense. But it should be done soon 🙂