2 ms·

I've never used Cloudflare so apologies for what is probably documented somewhere. Can the site owners not set JS requirements per-URL? I ask because the same

I've never used Cloudflare so apologies for what is probably documented somewhere. Can the site owners not set JS requirements per-URL? I ask because the same JS hidden browser tests can be added to NGinx and HAProxy using LUA scripting and it can be done by ACL for specific URL's. e.g. No-JS for static content and URL's that use GET but then require passing the JS hidden browser test prior to using a page that would require a POST. That is just one example of the myriad of possibilities. Can that not be set up in CF? Or is it all-or-none? For people not using a CDN and wanting to keep bots off the static content, this can for now be partially accomplished doing two things. Forcing HTTP/2.0 and one raw table iptables rule to drop TCP SYN packets that do not have an MSS in the desired range. Most poorly written bots do not even bother to set MSS. I'd wager this is something CF looks at in their eBPF logic. Blocking non HTTP/2.0 requests will drop all search engine crawlers except for Bing.

netsectoday 4y ago
I played with the HTTP/2.0 only protection a while back but had legit users complain that the site wouldn't load (they were running old browsers). How did you set up LUA scripting to provide a JS hidden browser test with Nginx and HAProxy?
- LinuxBender 4y ago
  To find the LUA scripts that do not depend on a centralized catcha service, search for "nginx lua ddos". [1][2] I do not have a live example at the moment as I took my hobby sites offline while the dust settles around the new California AB 2273 law. Most of these give site-wide examples but one can run the LUA by locations or other ACL's to protect specific resources or exclude specific resources from protection. e.g. RSS feeds. [1] - https://github.com/C0nw0nk/Nginx-Lua-Anti-DDoS https://github.com/C0nw0nk/Nginx-Lua-Anti-DDoS [2] - https://github.com/satrobit/lua-resty-ddos https://github.com/satrobit/lua-resty-ddos

netsectoday 4y ago

I played with the HTTP/2.0 only protection a while back but had legit users complain that the site wouldn't load (they were running old browsers). How did you set up LUA scripting to provide a JS hidden browser test with Nginx and HAProxy?

LinuxBender 4y ago
To find the LUA scripts that do not depend on a centralized catcha service, search for "nginx lua ddos". [1][2] I do not have a live example at the moment as I took my hobby sites offline while the dust settles around the new California AB 2273 law. Most of these give site-wide examples but one can run the LUA by locations or other ACL's to protect specific resources or exclude specific resources from protection. e.g. RSS feeds. [1] - https://github.com/C0nw0nk/Nginx-Lua-Anti-DDoS https://github.com/C0nw0nk/Nginx-Lua-Anti-DDoS [2] - https://github.com/satrobit/lua-resty-ddos https://github.com/satrobit/lua-resty-ddos