Skip to content

Set custom header (which can be processed by reverse proxy) #2357

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
int2001 merged 1 commit into from
Sep 27, 2025
Merged

Set custom header (which can be processed by reverse proxy) #2357

int2001 merged 1 commit into from
Sep 27, 2025

Conversation

@int2001
Copy link
Contributor

@int2001 int2001 commented Sep 27, 2025 •
edited
Loading

Set custom Header (X-Login-Status: failed) on failed login.
This one can be processed by your Reverseproxy to block/ban/tarpit a possible attacker.

Possible haproxy-Config in backend could be (This example blocks the requester IP for 5mins if there were more than 10 failed requests either on API or loginpage)

backend wavelog
        mode http
	stick-table type ipv6 size 100k expire 5m store gpc0
	http-request track-sc0 src
	acl ip_blocked sc0_get_gpc0 gt 10
	http-request deny deny_status 429 if ip_blocked
	acl login_failed status 401
	acl header_failed res.hdr(X-Login-Status) -i "failed"
	http-response sc-inc-gpc0(0) if login_failed or header_failed
        server local 127.0.0.1:81 check maxconn 250

@int2001 int2001 requested a review from HB9HIL September 27, 2025 10:43
@int2001 int2001 added the security Security related label Sep 27, 2025
phl0
phl0 approved these changes Sep 27, 2025
View reviewed changes
Copy link
Contributor

@phl0 phl0 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Worx

@int2001 int2001 merged commit b98ab2d into wavelog:dev Sep 27, 2025
@int2001 int2001 deleted the set_header branch November 11, 2025 11:25
@HB9HIL HB9HIL mentioned this pull request Nov 13, 2025
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@phl0 phl0 phl0 approved these changes

@HB9HIL HB9HIL Awaiting requested review from HB9HIL

Assignees

No one assigned

Labels

security Security related

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@int2001 @phl0