-
Notifications
You must be signed in to change notification settings - Fork 1.3k
Description
What happened?
When a fingerprint-based rule is active and an IP handler rule is simultaneously applied to the same source, the fingerprint data disappears from the logs (appears as empty records).
Specifically, while the IP is correctly caught and logged, the fingerprint field remains empty for some time or intermittently. This leads to cases where traffic bypasses fingerprint rules (returning HTTP 200 at the nginx-edge) because the system fails to "see" the fingerprint associated with that request/IP.
How we reproduce?
Create a blocking rule based on a specific fingerprint.
Identify an IP address performing scraping that should be blocked by fingerprint but is currently getting an HTTP 200 at the nginx-edge.
Apply an IP-based handler rule to that specific IP.
Monitor the logs for this IP:
Observed result: You will see logs of the IP being caught, but the fingerprint field in these entries is empty.
Intermittent behavior: After some time, the fingerprint might start appearing again, but not consistently.
Expected behavior
No response
Error log
