clawbot 54779f08de Trap paths, and the error burst banning a client refused too often (closes #115) ...

SWWAF_TRAP_PATHS: a request whose path, as a path rule sees it, is one
of them is a clear sign of attack, banned as a ban rule's match is; the
ban's notes give its trap_path. Checked after the rate limits, before the
rule files.

SWWAF_ERROR_BURST_THRESHOLD (default 30, or off): more refusals in a
minute after a block or ban rule or a trap path, or for a missing or
wrong token, ban the client as a broken limit does. Counted in
clients.json's minute_refusals; limit_hit error_burst, notes kind
refusals.

A token refusal is now the offence token_refused, and
smallwebwaf_offences_total counts every kind the history does.

Judgement call: the threshold is not lowered by a client's limit percentage.

Model: opus-5-5

2026-10-08 06:44:55 +02:00

..

admin_test.go

Ban notes name the reputation sources that listed the client (closes #109)

2026-10-08 03:08:01 +02:00

bans_test.go

Ban notes name the reputation sources that listed the client (closes #109)

2026-10-08 03:08:01 +02:00

bans.go

Trap paths, and the error burst banning a client refused too often (closes #115)

2026-10-08 06:44:55 +02:00

crowdsec_test.go

CrowdSec decision list fetched, kept, and its clients banned until the decision ends (closes #106)

2026-10-08 05:15:06 +02:00

snapshot_test.go

Ban notes name the reputation sources that listed the client (closes #109)

2026-10-08 03:08:01 +02:00