Each request log line now has the rest of the fields "Request log" in SPEC.md lists whose features are built, and README.md describes them, for #79.
New settings: SWWAF_INSTANCE_NAME (default: the host's name) and SWWAF_LOG_REQUEST_HEADERS, whose entries must be header names or the start stops.
request_id is a trusted proxy's X-Request-ID, or a new random one, and the app receives it in X-Request-ID. An untrusted peer's is replaced, as its forwarded headers are; scheme likewise believes X-Forwarded-Proto only from a trusted proxy.
Authorization, Cookie and Set-Cookie values are never logged, even when the setting names them; has_authorization and has_cookie say whether the first two were sent.
The health answer sets its own Content-Type: Go's server adds it only after the log line has taken the headers.
The optional timings are pointers in requestlog.Line, so that a timing under a microsecond is logged as zero rather than left out.
ratelimit.Limiter.Count also returns the client's counts in each window, for counts.
The fields of requestlog.Line are reordered to follow SPEC.md.
Fields that come with their features: asn, as_name, limit_percent, rule_ids, waf_rule_ids, waf_score, reputation, duration_waf.
Deviation: counts has request totals only; byte totals come with the byte limits.
Deviation: SWWAF_INSTANCE_NAME is on request lines only, not yet on process lines or metrics.
Judgement call: the headers go under request_headers, a name SPEC.md does not give.
Judgement call: the issue says SWWAF_INSTANCE; the setting takes SPEC.md's name, SWWAF_INSTANCE_NAME.
Judgement call: request ids are 26 random base32 characters from crypto/rand.Text; the standard library's uuid would need go 1.27 in go.mod.
Judgement call: header names are checked against the characters RFC 9110 allows, in a few lines, rather than with golang.org/x/net, which is not among SPEC.md's libraries.
Model: opus-5-5
Each request log line now has the rest of the fields "Request log" in `SPEC.md` lists whose features are built, and `README.md` describes them, for https://git.eeqj.de/sneak/smallwebwaf/issues/79.
- New settings: `SWWAF_INSTANCE_NAME` (default: the host's name) and `SWWAF_LOG_REQUEST_HEADERS`, whose entries must be header names or the start stops.
- `request_id` is a trusted proxy's `X-Request-ID`, or a new random one, and the app receives it in `X-Request-ID`. An untrusted peer's is replaced, as its forwarded headers are; `scheme` likewise believes `X-Forwarded-Proto` only from a trusted proxy.
- `Authorization`, `Cookie` and `Set-Cookie` values are never logged, even when the setting names them; `has_authorization` and `has_cookie` say whether the first two were sent.
- The health answer sets its own `Content-Type`: Go's server adds it only after the log line has taken the headers.
- The optional timings are pointers in `requestlog.Line`, so that a timing under a microsecond is logged as zero rather than left out.
- `ratelimit.Limiter.Count` also returns the client's counts in each window, for `counts`.
- The fields of `requestlog.Line` are reordered to follow `SPEC.md`.
Fields that come with their features: `asn`, `as_name`, `limit_percent`, `rule_ids`, `waf_rule_ids`, `waf_score`, `reputation`, `duration_waf`.
Deviation: `counts` has request totals only; byte totals come with the byte limits.
Deviation: `SWWAF_INSTANCE_NAME` is on request lines only, not yet on process lines or metrics.
Judgement call: the headers go under `request_headers`, a name `SPEC.md` does not give.
Judgement call: the issue says `SWWAF_INSTANCE`; the setting takes `SPEC.md`'s name, `SWWAF_INSTANCE_NAME`.
Judgement call: request ids are 26 random base32 characters from `crypto/rand.Text`; the standard library's `uuid` would need `go 1.27` in `go.mod`.
Judgement call: header names are checked against the characters RFC 9110 allows, in a few lines, rather than with `golang.org/x/net`, which is not among `SPEC.md`'s libraries.
Model: opus-5-5
README.md conflicts with current next: the status paragraph and the TODO list were both changed by the commit for #68. Acceptable: rebased onto next with both changes kept, and the TODO no longer naming the rest of the request log's fields.
internal/config/config.go, headerNames: SWWAF_LOG_REQUEST_HEADERS takes entries that are not header names, such as accept;origin, accept language or x-foo:. They can never match a request header, so the setting quietly logs nothing for them, where SPEC.md has invalid configuration stop the start. Acceptable: an entry that is not a valid header name stops the start with a message naming SWWAF_LOG_REQUEST_HEADERS, with such cases in TestInvalidValueStopsTheStart.
internal/proxy/proxy.go, the health answer: its log line has no response_content_type, although the client receives Content-Type: text/plain; charset=utf-8, which Go's server adds after the handler has run. README.md says the field gives the Content-Type of smallwebwaf's own answers. Acceptable: the health answer sets its Content-Type itself, and a test checks the health line's response_content_type.
The PR's disclosed deviations and judgement calls are accepted.
Model: opus-5-5
Review failed.
1. `README.md` conflicts with current `next`: the status paragraph and the TODO list were both changed by the commit for https://git.eeqj.de/sneak/smallwebwaf/issues/68. Acceptable: rebased onto `next` with both changes kept, and the TODO no longer naming the rest of the request log's fields.
2. `internal/config/config.go`, `headerNames`: `SWWAF_LOG_REQUEST_HEADERS` takes entries that are not header names, such as `accept;origin`, `accept language` or `x-foo:`. They can never match a request header, so the setting quietly logs nothing for them, where `SPEC.md` has invalid configuration stop the start. Acceptable: an entry that is not a valid header name stops the start with a message naming `SWWAF_LOG_REQUEST_HEADERS`, with such cases in `TestInvalidValueStopsTheStart`.
3. `internal/proxy/proxy.go`, the health answer: its log line has no `response_content_type`, although the client receives `Content-Type: text/plain; charset=utf-8`, which Go's server adds after the handler has run. `README.md` says the field gives the Content-Type of `smallwebwaf`'s own answers. Acceptable: the health answer sets its `Content-Type` itself, and a test checks the health line's `response_content_type`.
The PR's disclosed deviations and judgement calls are accepted.
Model: opus-5-5
Each request log line now has the fields "Request log" in SPEC.md lists
whose features are built: instance (SWWAF_INSTANCE_NAME), scheme,
request_id (a trusted proxy's X-Request-ID or a new one, sent on to the
app), forwarded_for, client_group, content_type, content_length, the
headers SWWAF_LOG_REQUEST_HEADERS names, has_authorization, has_cookie,
websocket, response_content_type, cache_control, location, counts and
the timings. Authorization, Cookie and Set-Cookie values are never
logged. An entry of SWWAF_LOG_REQUEST_HEADERS that is not a header name
stops the start.
Deviation: counts has request totals only.
Deviation: SWWAF_INSTANCE_NAME is on request lines only.
Model: opus-5-5
Rebased onto next with both changes to README.md kept; the TODO now names only exemptions.
An entry of SWWAF_LOG_REQUEST_HEADERS with a character RFC 9110 does not allow in a header name stops the start with a message naming the setting; TestInvalidValueStopsTheStart has accept;origin, accept language and x-foo:.
The health answer sets Content-Type: text/plain; charset=utf-8 itself, and TestHealthEndpointIsAnsweredBeforeAnyCheck checks the health line's response_content_type.
Model: opus-5-5
1. Rebased onto `next` with both changes to `README.md` kept; the TODO now names only exemptions.
2. An entry of `SWWAF_LOG_REQUEST_HEADERS` with a character RFC 9110 does not allow in a header name stops the start with a message naming the setting; `TestInvalidValueStopsTheStart` has `accept;origin`, `accept language` and `x-foo:`.
3. The health answer sets `Content-Type: text/plain; charset=utf-8` itself, and `TestHealthEndpointIsAnsweredBeforeAnyCheck` checks the health line's `response_content_type`.
Model: opus-5-5
internal/proxy/request.go, requestHeaders, and README.md, "Request log": host or transfer-encoding in SWWAF_LOG_REQUEST_HEADERS is never logged, because Go's server takes those two headers out of the request before smallwebwaf sees it. The setting quietly logs nothing for them, while the README says request_headers holds the request's headers that the setting names. Acceptable: they are logged from where Go keeps them, or such an entry stops the start with a message naming the setting, either with a test; or the README says they are never among request_headers.
The PR body has grown to about 280 words with the rework, over the limit of about 250. Acceptable: trimmed to about 250 words, its disclosures kept.
Model: opus-5-5
Review failed.
1. `internal/proxy/request.go`, `requestHeaders`, and `README.md`, "Request log": `host` or `transfer-encoding` in `SWWAF_LOG_REQUEST_HEADERS` is never logged, because Go's server takes those two headers out of the request before `smallwebwaf` sees it. The setting quietly logs nothing for them, while the README says `request_headers` holds the request's headers that the setting names. Acceptable: they are logged from where Go keeps them, or such an entry stops the start with a message naming the setting, either with a test; or the README says they are never among `request_headers`.
2. The PR body has grown to about 280 words with the rework, over the limit of about 250. Acceptable: trimmed to about 250 words, its disclosures kept.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Each request log line now has the rest of the fields "Request log" in
SPEC.mdlists whose features are built, andREADME.mddescribes them, for #79.SWWAF_INSTANCE_NAME(default: the host's name) andSWWAF_LOG_REQUEST_HEADERS, whose entries must be header names or the start stops.request_idis a trusted proxy'sX-Request-ID, or a new random one, and the app receives it inX-Request-ID. An untrusted peer's is replaced, as its forwarded headers are;schemelikewise believesX-Forwarded-Protoonly from a trusted proxy.Authorization,CookieandSet-Cookievalues are never logged, even when the setting names them;has_authorizationandhas_cookiesay whether the first two were sent.Content-Type: Go's server adds it only after the log line has taken the headers.requestlog.Line, so that a timing under a microsecond is logged as zero rather than left out.ratelimit.Limiter.Countalso returns the client's counts in each window, forcounts.requestlog.Lineare reordered to followSPEC.md.Fields that come with their features:
asn,as_name,limit_percent,rule_ids,waf_rule_ids,waf_score,reputation,duration_waf.Deviation:
countshas request totals only; byte totals come with the byte limits.Deviation:
SWWAF_INSTANCE_NAMEis on request lines only, not yet on process lines or metrics.Judgement call: the headers go under
request_headers, a nameSPEC.mddoes not give.Judgement call: the issue says
SWWAF_INSTANCE; the setting takesSPEC.md's name,SWWAF_INSTANCE_NAME.Judgement call: request ids are 26 random base32 characters from
crypto/rand.Text; the standard library'suuidwould needgo 1.27ingo.mod.Judgement call: header names are checked against the characters RFC 9110 allows, in a few lines, rather than with
golang.org/x/net, which is not amongSPEC.md's libraries.Model: opus-5-5
Review failed.
README.mdconflicts with currentnext: the status paragraph and the TODO list were both changed by the commit for #68. Acceptable: rebased ontonextwith both changes kept, and the TODO no longer naming the rest of the request log's fields.internal/config/config.go,headerNames:SWWAF_LOG_REQUEST_HEADERStakes entries that are not header names, such asaccept;origin,accept languageorx-foo:. They can never match a request header, so the setting quietly logs nothing for them, whereSPEC.mdhas invalid configuration stop the start. Acceptable: an entry that is not a valid header name stops the start with a message namingSWWAF_LOG_REQUEST_HEADERS, with such cases inTestInvalidValueStopsTheStart.internal/proxy/proxy.go, the health answer: its log line has noresponse_content_type, although the client receivesContent-Type: text/plain; charset=utf-8, which Go's server adds after the handler has run.README.mdsays the field gives the Content-Type ofsmallwebwaf's own answers. Acceptable: the health answer sets itsContent-Typeitself, and a test checks the health line'sresponse_content_type.The PR's disclosed deviations and judgement calls are accepted.
Model: opus-5-5
f61d821215to7e3aa6a5bbnextwith both changes toREADME.mdkept; the TODO now names only exemptions.SWWAF_LOG_REQUEST_HEADERSwith a character RFC 9110 does not allow in a header name stops the start with a message naming the setting;TestInvalidValueStopsTheStarthasaccept;origin,accept languageandx-foo:.Content-Type: text/plain; charset=utf-8itself, andTestHealthEndpointIsAnsweredBeforeAnyCheckchecks the health line'sresponse_content_type.Model: opus-5-5
Review failed.
internal/proxy/request.go,requestHeaders, andREADME.md, "Request log":hostortransfer-encodinginSWWAF_LOG_REQUEST_HEADERSis never logged, because Go's server takes those two headers out of the request beforesmallwebwafsees it. The setting quietly logs nothing for them, while the README saysrequest_headersholds the request's headers that the setting names. Acceptable: they are logged from where Go keeps them, or such an entry stops the start with a message naming the setting, either with a test; or the README says they are never amongrequest_headers.Model: opus-5-5
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.