Skip to content

Commit 3c52dfe

Browse files
documentation new haproxy spoa configuration for captcha redirect (#888)
* Implement native HAProxy redirect for CAPTCHA validation - Replace Lua-based redirect with native HAProxy 302 redirect for allow decisions - Add performance optimization by calling Lua only for ban and captcha remediations - Update both HAProxy configuration examples with the new approach - Add dedicated section explaining the performance benefits - Reduce overhead and improve scalability by minimizing Lua processing * Remove dedicated section, keep only updated configuration examples - Remove the standalone Native HAProxy Redirect section - Keep the updated configuration examples with native redirects and performance optimizations
1 parent aca2a0e commit 3c52dfe

File tree

1 file changed

+14
-2
lines changed

1 file changed

+14
-2
lines changed

crowdsec-docs/unversioned/bouncers/haproxy_spoa.mdx

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -169,7 +169,13 @@ frontend http-in
169169
bind *:80
170170
filter spoe engine crowdsec config /etc/haproxy/crowdsec.cfg
171171
http-request set-header X-CrowdSec-Remediation %[var(txn.crowdsec.remediation)]
172-
http-request lua.crowdsec_handle if { var(txn.crowdsec.remediation) -m found }
172+
173+
## Handle 302 redirect for successful captcha validation (native HAProxy redirect)
174+
http-request redirect code 302 location %[var(txn.crowdsec.redirect)] if { var(txn.crowdsec.remediation) -m str "allow" } { var(txn.crowdsec.redirect) -m found }
175+
176+
## Call lua script only for ban and captcha remediations (performance optimization)
177+
http-request lua.crowdsec_handle if { var(txn.crowdsec.remediation) -m str "captcha" }
178+
http-request lua.crowdsec_handle if { var(txn.crowdsec.remediation) -m str "ban" }
173179
174180
## Handle captcha cookie management via HAProxy (new approach)
175181
## Set captcha cookie when SPOA provides captcha_status (pending or valid)
@@ -399,7 +405,13 @@ frontend test
399405
400406
http-request set-header X-CrowdSec-Remediation %[var(txn.crowdsec.remediation)] if { var(txn.crowdsec.remediation) -m found }
401407
http-request set-header X-CrowdSec-IsoCode %[var(txn.crowdsec.isocode)] if { var(txn.crowdsec.isocode) -m found }
402-
http-request lua.crowdsec_handle if { var(txn.crowdsec.remediation) -m found }
408+
409+
## Handle 302 redirect for successful captcha validation (native HAProxy redirect)
410+
http-request redirect code 302 location %[var(txn.crowdsec.redirect)] if { var(txn.crowdsec.remediation) -m str "allow" } { var(txn.crowdsec.redirect) -m found }
411+
412+
## Call lua script only for ban and captcha remediations (performance optimization)
413+
http-request lua.crowdsec_handle if { var(txn.crowdsec.remediation) -m str "captcha" }
414+
http-request lua.crowdsec_handle if { var(txn.crowdsec.remediation) -m str "ban" }
403415
404416
## Handle captcha cookie management via HAProxy (new approach)
405417
## Set captcha cookie when SPOA provides captcha_status (pending or valid)

0 commit comments

Comments
 (0)