chaitin / chaitin/SafeLine

[Bug] Missing or empty fingerprints in logs when IP-based handler is active

Open
#1,276 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
22.6k
Forks
1.5k
Avg merge
4h 30m
Merged PRs (30d)
11

Description

What happened?

When a fingerprint-based rule is active and an IP handler rule is simultaneously applied to the same source, the fingerprint data disappears from the logs (appears as empty records).
Specifically, while the IP is correctly caught and logged, the fingerprint field remains empty for some time or intermittently. This leads to cases where traffic bypasses fingerprint rules (returning HTTP 200 at the nginx-edge) because the system fails to "see" the fingerprint associated with that request/IP.

How we reproduce?

Create a blocking rule based on a specific fingerprint.

Identify an IP address performing scraping that should be blocked by fingerprint but is currently getting an HTTP 200 at the nginx-edge.

Apply an IP-based handler rule to that specific IP.

Monitor the logs for this IP:

Observed result: You will see logs of the IP being caught, but the fingerprint field in these entries is empty.

Intermittent behavior: After some time, the fingerprint might start appearing again, but not consistently.

Expected behavior

No response

Error log
Image Image Image

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing the IP-based handler and fingerprint rule paths into the request logs, using the reproduction steps to compare requests with both rules active. Determine where the fingerprint becomes empty and verify that fingerprints remain present in logs and fingerprint rules continue to apply consistently when an IP handler is also active.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, nginx
Domain
observability, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.