- Ya
- 5 Agosti 2026, 06:54 UTC
- Mwandishi
- kamo
- Ahadi ya
- 28af1c6
checkAccess evaluated the rules itself and matched nothing for its entire life: it compared rule types against **************** while the publisher writes the enum names WHITELIST/BLACKLIST/TEMP_BLOCK. Geo was a comment saying Node has no GeoLite database. Both halves are gone — it now reads the verdict SecurityService caches in Redis and asks that service on a miss, so there is one implementation of the policy and no copy left here to drift. The address is the right-most public hop of X-Forwarded-For rather than the left-most. Proxies append, so the left element is whatever the client sent, and reading it would have let a header decide which country the visitor is treated as being in. A blocked visitor now gets a plain 403 document instead of raw JSON — this reaches a browser doing a top-level navigation. It names no rule and no country: the reader cannot act on that, and someone probing the boundary should not be handed a map of it. Fails open on every path. A proxy that blocks when Redis is briefly unreachable takes the whole tenant offline.