Ten tests in internal/proxy set a country list, a biased threshold or
SWWAF_ADD_LOOKUP_HEADERS, and expected the GeoJS stand-in's answer within
the default SWWAF_LOOKUP_TIMEOUT of one second on the real clock. A
hold-up of the test process past it left the client unknown. Each now
sets SWWAF_LOOKUP_TIMEOUT to an hour, and the comment on startGeoJS asks
the same of later tests.
Judgement call: set in each test, not as a default in newProxy, where it
would change two tests that rely on the default second.
Model: opus-5-5
SWWAF_TRAP_PATHS: a request whose path, as a path rule sees it, is one
of them is a clear sign of attack, banned as a ban rule's match is; the
ban's notes give its trap_path. Checked after the rate limits, before the
rule files.
SWWAF_ERROR_BURST_THRESHOLD (default 30, or off): more refusals in a
minute after a block or ban rule or a trap path, or for a missing or
wrong token, ban the client as a broken limit does. Counted in
clients.json's minute_refusals; limit_hit error_burst, notes kind
refusals.
A token refusal is now the offence token_refused, and
smallwebwaf_offences_total counts every kind the history does.
Judgement call: the threshold is not lowered by a client's limit percentage.
Model: opus-5-5
clawbot