I already experienced this in production, if the modsec instance is unable to keep up with the load, it will fail some requests, resulting in 502 errors under high load.
Or if for whatever reason the modsec service is down or temporarily unavailable, the whole middleware goes down. Too risky for something that is part of the critical path.
In this PR I'm proposing a new configuration setting UnhealthyWafBackOffPeriodSecs that will backoff from using the modsec ir a request fails to reach the modsec.
#19
Of course one can think that with this setting you can evade the WAF with some DDoS, and you can indeed. But I'd rather have that than the whole ingress down. And even in those situations there are other protection layers. Plus, it's Opt-in, default behaviour is what it was before (502 when waf is down).
I already experienced this in production, if the modsec instance is unable to keep up with the load, it will fail some requests, resulting in 502 errors under high load.
Or if for whatever reason the modsec service is down or temporarily unavailable, the whole middleware goes down. Too risky for something that is part of the critical path.
In this PR I'm proposing a new configuration setting UnhealthyWafBackOffPeriodSecs that will backoff from using the modsec ir a request fails to reach the modsec.
#19
Of course one can think that with this setting you can evade the WAF with some DDoS, and you can indeed. But I'd rather have that than the whole ingress down. And even in those situations there are other protection layers. Plus, it's Opt-in, default behaviour is what it was before (502 when waf is down).