LoginSign Up
← Back to all sparks
C

CrowdSec

INFRA · APIS
Velocity5.0

Collaborative behaviour-based intrusion prevention engine

crowdsec.net ↗

CrowdSec's 1.8.2 candidates let operators write their own bot fingerprints.

wafbot-detectionsecurityfingerprintingrelease-candidate
◆Current state
The bot detection introduced with 1.8 is now being opened to customization. The 1.8.2 candidates add custom JavaScript fingerprinting, a cscli bot subcommand and a FlagSubmission helper, and rc2 adds a RateLimit helper for the WAF plus a cookie option for embedded contexts. Operational work runs alongside it: a cs_features metric, optional limits on concurrent decision streams and TLS certificate reloads.
◆Where it's heading
The WAF remains the center of gravity, and the direction is programmability. RateLimit, SkipProcessing and the fingerprinting hooks give rule authors primitives rather than fixed behavior. The LAPI changes point at larger deployments, where decision streaming puts load on the central API.
◆Prediction
The final 1.8.2 is dated 26 October on GitHub, though it has not reached this feed yet. Whether fingerprint data ever joins the community blocklist remains unanswered in these notes.

◆Recent moves

  1. 11d ago

    1.8.2 rc2 adds a WAF RateLimit helper and decision stream limits

    rc2 extends the bot-detection work with a RateLimit helper for the WAF and SameSite=None partitioned cookies, plus limits on concurrent decision streams. It gives rule authors more primitives rather than new fixed behavior.

    View source ↗
  2. 20d ago

    1.8.2 rc1 adds custom JS fingerprinting for bot detection

    The 1.8.2 cycle opens with custom JavaScript fingerprinting for bot detection and a cscli bot subcommand, moving the 1.8 feature from a fixed challenge toward something operators can extend.

    View source ↗
  3. 2mo ago

    1.8 rc2 tunes the bot-detection challenge, hardens acquisition

    A second candidate restating rc1's feature notes with the bot-detection flow refined: configurable challenge thresholds, an explicit error when cookies are disabled, unified scoring, harder proof-of-work, and a fixed pre-warmer goroutine leak. It also caps body sizes on k8s-audit and HTTP acquisition and revamps cscli console status, which reads as the pre-GA tightening pass rather than new capability.

    View source ↗
  4. 3mo ago

    CrowdSec 1.8 RC adds WAF bot detection and a Kubernetes datasource

    ⚡ SPARK

    The origin of the 1.8 line and the point where CrowdSec's WAF stopped being a rule engine and started challenging clients directly. Everything in rc2 refines what this candidate introduced.

    View source ↗
  5. 6mo ago

    1.7.8 RC: OpenAPI schema validation in the WAF

    Adds OpenAPI schema validation so the WAF can reject requests that violate a declared API contract, alongside body size limits and chunked decision streaming by default. Part of the steady build-out that made the WAF the centre of gravity ahead of 1.8.

    View source ↗
  6. 7mo ago

    1.7.7 RC: flexible WAF rule conditions and RE2 by default

    Lets WAF rules mix AND and OR conditions arbitrarily, enables RE2 by default on Linux, and exposes more Coraza transformations. Expressiveness work that made the later challenge-rule model practical.

    View source ↗