search

maxlerebourg / crowdsec-bouncer-traefik-plugin

Traefik plugin for Crowdsec - WAF and IP protection
Apache License 2.0
260 stars 14 forks source link

[BUG] AppSec URI Doesnt Pass Query String #151

Closed LaurenceJJones closed 7 months ago

LaurenceJJones commented 7 months ago

Describe the bug 🐛

Hey 👋🏻 I am working on a official "AppSec" library that will be aimed to be incorporated into the main "go-cs-bouncer" package. However, I was writing some test cases and saw the value you pass within X-Crowdsec-Appsec-Uri is Url.Path this means only the path is sent none of the query arguments.

Expected behavior 👀

For the query parameters to also be passed to the AppSec you should just use Url.String()

Context 🔎 I havent officially tested it within your package, it just what I saw in the code and the behaviour that I saw within my library. If you need anymore context I can provide some.

maxlerebourg commented 7 months ago

Thanks for this bug, we will fix it asap

Another point to see with you (as contact point from Crowdsec): To implement the logic of captcha with appsec, do we need to cache the result from the lapi ?

https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/issues/150 I let the link of the issue here if you want more information.