-
Notifications
You must be signed in to change notification settings - Fork 41
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
how to tell coraza not to buffer responses? #148
Comments
Unfortunately it's impossible to process the request with blocking capabilities without buffering. |
double checking - you are talking about response? buffering a request and then processing its body etc is ok. but buffering corresponding response from the server is the problem. |
Same applies for responses, but it might not affect CRS unless you enable anomaly scoring mode. I think it wouldn't damage to allow users to stream the response body. We could even use an action to tell the connector to stream |
You can disable request body inspection and that should do the trick but that is a big risk of leaking data in response payload.
|
We're finding that even if we include the directive |
If that is the case then that might be a bug. According to https://github.com/corazawaf/coraza-caddy/blob/main/interceptor.go#L118-L120 it should not be buffered. Any chance caddy does the buffering? cc @mholt |
Caddy does not buffer responses unless there is special processing required -- this usually requires explicit configuration (for example, the |
I am using caddy as https reverse proxy with coraza. my app streams response. w/o coraza I see page rendered gradually. with coraza I get whole page after delay. Even with empty coraza config it is still buffering.
how to tell coraza not to buffer responses?
The text was updated successfully, but these errors were encountered: