-
Notifications
You must be signed in to change notification settings - Fork 8
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #111 from fingerprintjs/feat/firewall-demo
Firewall demo hidden release
- Loading branch information
Showing
30 changed files
with
2,626 additions
and
1,828 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -56,3 +56,6 @@ tsconfig.tsbuildinfo | |
|
|
||
| # MacOS Finder | ||
| .DS_Store | ||
|
|
||
| # Local experiments | ||
| .scratchpad/* | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| import { BlockedIpDbModel } from '../src/server/botd-firewall/blockedIpsDatabase'; | ||
| import { Op } from 'sequelize'; | ||
| import { syncFirewallRuleset } from '../src/server/botd-firewall/cloudflareApiHelper'; | ||
| import { schedule } from 'node-cron'; | ||
| import { HOUR_MS } from '../src/shared/timeUtils'; | ||
| import 'dotenv/config'; | ||
|
|
||
| /** | ||
| * In production, run this file in conjunction with the production web server like: | ||
| * yarn start:with-cron-jobs | ||
| */ | ||
|
|
||
| // Every 5 minutes | ||
| schedule('*/5 * * * *', () => { | ||
| deleteOldIpBlocks(); | ||
| }); | ||
|
|
||
| const IP_BLOCK_TIME_TO_LIVE_MS = HOUR_MS; | ||
|
|
||
| async function deleteOldIpBlocks() { | ||
| try { | ||
| // Remove expired IP blocks | ||
| const deletedCount = await BlockedIpDbModel.destroy({ | ||
| where: { | ||
| timestamp: { | ||
| [Op.lt]: new Date(Date.now() - IP_BLOCK_TIME_TO_LIVE_MS).toISOString(), | ||
| }, | ||
| }, | ||
| }); | ||
|
|
||
| console.log(`Deleted ${deletedCount} expired blocked IPs from the database.`); | ||
|
|
||
| /** | ||
| * Construct updated firewall rules from the blocked IP database and apply them to the Cloudflare application. | ||
| * Note: We do this even if no IPs were deleted: | ||
| * A user might have blocked their IP but the database might have been cleared during site deployment right after, | ||
| * potentially leaving the IP blocked beyond the desired TTL. Safer to sync the firewall ruleset every time. | ||
| */ | ||
| await syncFirewallRuleset(); | ||
| console.log(`Updated Cloudflare firewall.`); | ||
| } catch (error) { | ||
| console.error(`Error deleting old blocked IPs: ${error}`); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,48 @@ | ||
| import { expect, test } from '@playwright/test'; | ||
| import { resetScenarios } from './resetHelper'; | ||
| import { TEST_IDS } from '../src/client/testIDs'; | ||
| import { BOT_FIREWALL_COPY } from '../src/client/bot-firewall/botFirewallCopy'; | ||
|
|
||
| /** | ||
| * CHROME_ONLY flag tells the GitHub action to run this test only using Chrome. | ||
| * This test relies on a single common Cloudflare ruleset, we we cannot run multiple instances of it at the same time. | ||
| */ | ||
| test.describe('Bot Firewall Demo CHROME_ONLY', () => { | ||
| test.beforeEach(async ({ page }) => { | ||
| await page.goto('/coupon-fraud'); | ||
| await resetScenarios(page); | ||
| }); | ||
|
|
||
| test('Should display bot visit and allow blocking/unblocking its IP address', async ({ page, context }) => { | ||
| // Record bot visit in web-scraping page | ||
| await page.goto('/web-scraping'); | ||
| await expect(page.getByTestId(TEST_IDS.common.alert)).toContainText('Malicious bot detected'); | ||
|
|
||
| // Check bot visit record and block IP | ||
| await page.goto('/bot-firewall'); | ||
| await page.getByRole('button', { name: BOT_FIREWALL_COPY.blockIp }).first().click(); | ||
| await page.getByText('was blocked in the application firewall').waitFor(); | ||
| await page.waitForTimeout(3000); | ||
|
|
||
| /** | ||
| * Try to visit web-scraping page, should be blocked by Cloudflare | ||
| * Checking the response code here as parsing the actual page if flaky for some reason. | ||
| * Using a separate tab also seems to help with flakiness. | ||
| */ | ||
| const secondTab = await context.newPage(); | ||
| await secondTab.goto('https://staging.fingerprinthub.com/web-scraping'); | ||
| await secondTab.reload(); | ||
| await secondTab.getByRole('heading', { name: 'Sorry, you have been blocked' }).waitFor(); | ||
|
|
||
| // Unblock IP | ||
| await page.goto('/bot-firewall'); | ||
| await page.getByRole('button', { name: BOT_FIREWALL_COPY.unblockIp }).first().click(); | ||
| await page.getByText('was unblocked in the application firewall').waitFor(); | ||
| await page.waitForTimeout(3000); | ||
|
|
||
| // Try to visit web-scraping page, should be allowed again | ||
| await secondTab.goto('https://staging.fingerprinthub.com/web-scraping'); | ||
| await secondTab.reload(); | ||
| await expect(secondTab.getByTestId(TEST_IDS.common.alert)).toContainText('Malicious bot detected'); | ||
| }); | ||
| }); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| export const BOT_FIREWALL_COPY = { | ||
| blockIp: 'Block this IP', | ||
| unblockIp: 'Unblock', | ||
| } as const; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.