we will want tls fingerprints in the decider, and traefik doesn’t support passing them back as headers.
Traefik gains the fingerprints in clawbot/traefik#1. With its option on, every request it forwards carries the client's JA4 and JA3 TLS fingerprints in the headers X-TLS-JA4 and X-TLS-JA3.
Definition of done:
rproxy passes both headers to servewaf with each request it asks about. The headers carry nothing else: traefik removes client-sent copies before forwarding.
servewaf writes both into its log line for every decision, next to the client's address, so real-world logs can be grouped by fingerprint.
Both are available to every heuristic module (#195). No heuristic acts on them until sneak specifies one.
A request without the headers is handled as today.
sneak, in chat on 6 November:
> we will want tls fingerprints in the decider, and traefik doesn’t support passing them back as headers.
Traefik gains the fingerprints in https://git.eeqj.de/clawbot/traefik/issues/1. With its option on, every request it forwards carries the client's JA4 and JA3 TLS fingerprints in the headers `X-TLS-JA4` and `X-TLS-JA3`.
**Definition of done:**
- `rproxy` passes both headers to `servewaf` with each request it asks about. The headers carry nothing else: traefik removes client-sent copies before forwarding.
- `servewaf` writes both into its log line for every decision, next to the client's address, so real-world logs can be grouped by fingerprint.
- Both are available to every heuristic module (https://git.eeqj.de/sneak/smallwebwaf/issues/195). No heuristic acts on them until sneak specifies one.
- A request without the headers is handled as today.
- `make check` passes.
This comes after https://git.eeqj.de/sneak/smallwebwaf/issues/195.
Model: opus-5-5
clawbot
self-assigned this 2026-11-06 18:43:48 +01:00
Paused indefinitely by sneak in chat on 6 November: this cannot proceed until traefik is patched (clawbot/traefik#1). For smallwebwaf's manager: skip this issue. Do not start it until sneak resumes it here.
Model: opus-5-5
Paused indefinitely by sneak in chat on 6 November: this cannot proceed until traefik is patched (https://git.eeqj.de/clawbot/traefik/issues/1). **For smallwebwaf's manager:** skip this issue. Do not start it until sneak resumes it here.
Model: opus-5-5
Plan for the implementer. Start from next after #195 has landed.
rproxy (internal/rproxy/servewaf.go, where the question is built): the question already carries the visitor's headers. Keep X-TLS-JA4 and X-TLS-JA3 on it only when rproxy's direct peer is in SWRP_TRUSTED_PROXIES (the request's peerTrusted); otherwise delete both, so a client that reaches rproxy without traefik cannot set them. This follows the standing rule that forwarded headers count only from a trusted peer. Test both cases in internal/rproxy.
servewaf (internal/servewaf/request.go, where the log line is started): copy the two headers into two new log fields in internal/requestlog, tls_ja4 and tls_ja3, placed right after client_ip and left out when empty. They are on every log line, the allowed requests' included. Heuristics read them from the request's log line; none acts on them.
A request without the headers is handled and logged as today.
Docs:docs/request-log.md documents both fields. SPEC.md's section "The question" says, in one sentence, that rproxy passes these two headers on from a trusted peer only. README.md gets one sentence in its traefik section: when traefik adds these headers, servewaf logs them.
Tests in internal/servewaf: a question with both headers logs both; one without logs neither. make check passes.
Model: opus-5-5
Plan for the implementer. Start from `next` after https://git.eeqj.de/sneak/smallwebwaf/issues/195 has landed.
- **rproxy** (`internal/rproxy/servewaf.go`, where the question is built): the question already carries the visitor's headers. Keep `X-TLS-JA4` and `X-TLS-JA3` on it only when rproxy's direct peer is in `SWRP_TRUSTED_PROXIES` (the request's `peerTrusted`); otherwise delete both, so a client that reaches rproxy without traefik cannot set them. This follows the standing rule that forwarded headers count only from a trusted peer. Test both cases in `internal/rproxy`.
- **servewaf** (`internal/servewaf/request.go`, where the log line is started): copy the two headers into two new log fields in `internal/requestlog`, `tls_ja4` and `tls_ja3`, placed right after `client_ip` and left out when empty. They are on every log line, the allowed requests' included. Heuristics read them from the request's log line; none acts on them.
- A request without the headers is handled and logged as today.
- **Docs:** `docs/request-log.md` documents both fields. `SPEC.md`'s section "The question" says, in one sentence, that rproxy passes these two headers on from a trusted peer only. `README.md` gets one sentence in its traefik section: when traefik adds these headers, servewaf logs them.
- **Tests** in `internal/servewaf`: a question with both headers logs both; one without logs neither. `make check` passes.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
sneak, in chat on 6 November:
Traefik gains the fingerprints in clawbot/traefik#1. With its option on, every request it forwards carries the client's JA4 and JA3 TLS fingerprints in the headers
X-TLS-JA4andX-TLS-JA3.Definition of done:
rproxypasses both headers toservewafwith each request it asks about. The headers carry nothing else: traefik removes client-sent copies before forwarding.servewafwrites both into its log line for every decision, next to the client's address, so real-world logs can be grouped by fingerprint.make checkpasses.This comes after #195.
Model: opus-5-5
Paused indefinitely by sneak in chat on 6 November: this cannot proceed until traefik is patched (clawbot/traefik#1). For smallwebwaf's manager: skip this issue. Do not start it until sneak resumes it here.
Model: opus-5-5
Plan for the implementer. Start from
nextafter #195 has landed.internal/rproxy/servewaf.go, where the question is built): the question already carries the visitor's headers. KeepX-TLS-JA4andX-TLS-JA3on it only when rproxy's direct peer is inSWRP_TRUSTED_PROXIES(the request'speerTrusted); otherwise delete both, so a client that reaches rproxy without traefik cannot set them. This follows the standing rule that forwarded headers count only from a trusted peer. Test both cases ininternal/rproxy.internal/servewaf/request.go, where the log line is started): copy the two headers into two new log fields ininternal/requestlog,tls_ja4andtls_ja3, placed right afterclient_ipand left out when empty. They are on every log line, the allowed requests' included. Heuristics read them from the request's log line; none acts on them.docs/request-log.mddocuments both fields.SPEC.md's section "The question" says, in one sentence, that rproxy passes these two headers on from a trusted peer only.README.mdgets one sentence in its traefik section: when traefik adds these headers, servewaf logs them.internal/servewaf: a question with both headers logs both; one without logs neither.make checkpasses.Model: opus-5-5