docs(appsec): document bot-detection/challenge mode (early feature) - #22
Open
sabban wants to merge 1 commit into
Open
docs(appsec): document bot-detection/challenge mode (early feature)#22sabban wants to merge 1 commit into
sabban wants to merge 1 commit into
Conversation
Folds into the existing appsec silo rather than a new file, since the upstream feature is expected to stabilize soon: - configure.md: the challenge: config block, the two new hook phases (on_challenge/on_challenge_submit), the core SendChallenge() gate, known-bot exemption via MatchKnownBot()/ExemptFromChallenge(), and the full challenge-related hook function table - deploy.md: installing crowdsecurity/appsec-bot-challenge via the hub_branch override (not on the released hub index yet), and the bouncer-side requirement to route challenge protocol paths through the same middleware and relay the structured JSON envelope Everything in both sections was run against a real crowdsec:dev + Traefik (local-plugin build of crowdsec-bouncer-traefik-plugin#343) deployment, not inferred from docs. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Folded into the existing
appsec/silo (rather than a new file/subdir) since the upstream feature is expected to stabilize soon:configure.md: thechallenge:config block, the two new hook phases (on_challenge/on_challenge_submit— fixed the stale "three phases" claim, it's six now), the coreSendChallenge()gate, known-bot exemption viaMatchKnownBot()/ExemptFromChallenge(), authoring your own bot datafile, and the full challenge-related hook function table.deploy.md: installingcrowdsecurity/appsec-bot-challengevia thehub_branchoverride (not on the released hub index yet — cross-links to docs(hub): document cscli.hub_branch for pinning to a pre-merge hub branch #21's new hub.md section), and the bouncer-side requirement (route challenge protocol paths through the same middleware, parse+relay the structured JSON envelope) with a Traefik local-plugin example.SKILL.mdrouter entry.Explicitly flagged as an early/unreleased feature throughout (engine support is on crowdsec
masterpost-v1.7.8 with no numbered release yet; the hub collection is an upstream[do-not-merge]PR; the Traefik bouncer support is an open plugin PR) rather than presented as stable.Verification
Everything in both sections was run against a real
crowdsec:dev+ Traefik deployment (Traefik running the plugin as a local build ofmaxlerebourg/crowdsec-bouncer-traefik-plugin#343), not inferred from docs — including installing the real hub collection (via #21'shub_branchtrick), the challenge envelope round-trip through Traefik, and known-bot exemption via a hand-authored datafile.verified:frontmatter added to both files (env: docker, 2026-07-17).Depends conceptually on #21 (hub_branch doc) for the install step's cross-reference, but stands alone — reviewable independently.
Test plan
python3 skills/crowdsec/scripts/check-verification.py— both new entries parse, 0d ageclaude plugin validate .— passescscli metrics show appsec