[Bug] 切换应用防护模式后，BOT防护未开启但请求仍被拦截
Open
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 22.6k
- Forks
- 1.5k
- Avg merge
- 4h 30m
- Merged PRs (30d)
- 11
Description
What happened?
切换应用防护模式后，BOT防护未开启但请求仍被拦截，waf版本为9.2.1
How we reproduce?
- 关闭应用的 BOT 防护功能；
- 将应用防护模式切换为 “观察模式” 并保存配置；
- 再次将应用防护模式切换回 “防护模式” 并保存配置；
- 请求受防护的应用接口，此时请求被错误拦截，并返回 468状态码。
Expected behavior
当切换回“防护模式”且未开启 BOT 防护时，请求应被正常放行并访问成功。
Error log
应用访问日志：
127.0.0.1 - - [24/Aug/2025:18:46:24 +0800] "GET /webhook/8f68236f HTTP/1.1" 468 14861 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36" "180.x.x.x"
127.0.0.1 - - [24/Aug/2025:18:50:51 +0800] "GET /webhook/814a63e6 HTTP/1.1" 468 14861 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36" "180.x.x.x"
127.0.0.1 - - [24/Aug/2025:18:51:07 +0800] "GET /webhook/8f68236f HTTP/1.1" 468 14861 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36" "180.x.x.x"
127.0.0.1 - - [24/Aug/2025:18:52:14 +0800] "GET /webhook/8f68236f HTTP/1.1" 468 14861 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36" "180.x.x.x"
127.0.0.1 - - [24/Aug/2025:18:53:05 +0800] "GET /webhook/8f68236f HTTP/1.1" 468 14861 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36" "180.x.x.x"
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No source files, tests, or entry points are named. Start by reproducing the configuration transition from observation mode back to protection mode with BOT protection disabled, then trace the logic producing HTTP 468 responses; done means the request is allowed after the transition and regression coverage verifies it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100