Frank
a8206a42ae
The catch-all path_regex "." policy challenged everything, including Anubis's own API namespace /.within.website/x/cmd/anubis/* (make-challenge, pass-challenge, static assets). In whole-request proxy mode a JS-capable browser POSTs its challenge solution to pass-challenge and received another challenge page (HTML) instead of the verification verdict (JSON): the challenge app's fetch failed and the browser rendered its own error — 'the request filters did not return an alternative response'. Non-JS clients never POST the solution, so every curl probe looked green while every human hit a wall. Accept rule ordered above the catch-all; policy is volume-mounted ro from this checkout, so the deploy updates it in place.
21 lines
595 B
JSON
21 lines
595 B
JSON
{
|
|
"bots": [
|
|
{
|
|
"name": "deny AI scrapers",
|
|
"user_agent_regex": "(?i)^(GPTBot|ChatGPT-User|OAI-SearchBot|CCBot|anthropic-ai|ClaudeBot|Claude-Web|PerplexityBot|PerplexityUser|Google-Extended|Applebot-Extended|Bytespider|Amazonbot|meta-externalagent|DuckAssistBot|cohere-ai|YouBot|KimiBot)",
|
|
"action": "DENY"
|
|
},
|
|
{
|
|
"name": "serve anubis own endpoints",
|
|
"path_regex": "^/\\.within\\.website",
|
|
"action": "ACCEPT"
|
|
},
|
|
{
|
|
"name": "challenge everything else",
|
|
"path_regex": ".",
|
|
"action": "CHALLENGE"
|
|
}
|
|
],
|
|
"dnsbl": false
|
|
}
|