updating to DataDome Fastly Module 2.23.0 (#7)

etc/fastly_edge_modules/datadome_integration.json

@@ -68,7 +68,7 @@
   "vcl": [
     {
       "priority": 7,
-      "template": "sub set_origin_header {\n  if (req.backend.is_origin) {\n    if (req.backend == datadome) {\n        # Remove all unexpected headers\n        header.filter_except(bereq, \"x-datadome-params\", \"accept-charset\", \"accept-language\", \"x-requested-with\", \"x-fl-productid\", \"x-flapi-session-id\", \"fastly-orig-accept-encoding\", \"cache-control\", \"client-id\", \"connection\", \"pragma\", \"accept\", \"headers-list\", \"host\", \"origin\", \"server-hostname\", \"server-name\", \"x-forwarded-for\", \"user-agent\", \"referer\", \"request\", \"content-type\", \"from\", \"true-client-ip\", \"via\", \"x-real-ip\", \"sec-ch-device-memory\", \"sec-ch-ua\", \"sec-ch-ua-arch\", \"sec-ch-ua-full-version-list\", \"sec-ch-ua-mobile\", \"sec-ch-ua-model\", \"sec-ch-ua-platform\", \"sec-fetch-dest\", \"sec-fetch-mode\", \"sec-fetch-site\", \"sec-fetch-user\");\n        set bereq.http.x-datadome-params:key = \"{{datadome_api_key}}\";\n        set bereq.http.x-datadome-params:requestmodulename = \"FastlyMagento\";\n        set bereq.http.x-datadome-params:moduleversion = \"2.22.0\";\n        set bereq.http.x-datadome-params:timerequest = time.start.usec;\n        set bereq.http.x-datadome-params:servername = server.identity;\n        set bereq.http.x-datadome-params:serverregion = server.region;\n        set bereq.http.x-datadome-params:ip = urlencode(client.ip);\n        set bereq.http.x-forwarded-proto = urlencode(req.protocol);\n        set bereq.http.x-datadome-params:authorizationlen = std.strlen(req.http.authorization);\n        # Truncating Headers - Start\n        set bereq.http.accept-charset = substr(req.http.accept-charset, 0, 128);\n        set bereq.http.accept-language = substr(req.http.accept-language, 0, 256);\n        set bereq.http.x-requested-with = substr(req.http.x-requested-with, 0, 128);\n        set bereq.http.x-fl-productid = substr(req.http.x-fl-productid, 0, 64);\n        set bereq.http.x-flapi-session-id = substr(req.http.x-flapi-session-id, 0, 64);\n        set bereq.http.fastly-orig-accept-encoding = substr(req.http.fastly-orig-accept-encoding, 0, 128);\n        set bereq.http.cache-control = substr(req.http.cache-control, 0, 128);\n        set bereq.http.client-id = substr(req.http.client-id, 0, 128);\n        set bereq.http.connection = substr(req.http.connection, 0, 128);\n        set bereq.http.pragma = substr(req.http.pragma, 0, 128);\n        set bereq.http.accept = substr(req.http.accept, 0, 512);\n        set bereq.http.headers-list = substr(req.http.headers-list, 0, 512);\n        set bereq.http.host = substr(req.http.host, 0, 512);\n        set bereq.http.origin = substr(req.http.origin, 0, 512);\n        set bereq.http.server-hostname = substr(req.http.server-hostname, 0, 512);\n        set bereq.http.server-name = substr(req.http.server-name, 0, 512);\n        if( std.strlen(req.http.x-forwarded-for) \u003e 512 ) {\n            # Truncate from the end\n            set bereq.http.x-forwarded-for = substr(req.http.x-forwarded-for, -512);\n        } else {\n            set bereq.http.x-forwarded-for = req.http.x-forwarded-for;\n        }\n        set bereq.http.user-agent = substr(req.http.user-agent, 0, 768);\n        set bereq.http.referer = substr(req.http.referer, 0, 1024);\n        set bereq.http.request = substr(req.http.request, 0, 2048);\n        set bereq.http.content-type = substr(req.http.content-type, 0, 64);\n        set bereq.http.from = substr(req.http.from, 0, 128);\n        set bereq.http.true-client-ip = substr(req.http.true-client-ip, 0, 128);\n        set bereq.http.via = substr(req.http.via, 0, 256);\n        set bereq.http.x-real-ip = substr(req.http.x-real-ip, 0, 128);\n        set bereq.http.sec-ch-device-memory = substr(req.http.sec-ch-device-memory, 0, 8);\n        set bereq.http.sec-ch-ua = substr(req.http.sec-ch-ua, 0, 128);\n        set bereq.http.sec-ch-ua-arch = substr(req.http.sec-ch-ua-arch, 0, 16);\n        set bereq.http.sec-ch-ua-full-version-list = substr(req.http.sec-ch-ua-full-version-list, 0, 256);\n        set bereq.http.sec-ch-ua-mobile = substr(req.http.sec-ch-ua-mobile, 0, 8);\n        set bereq.http.sec-ch-ua-model = substr(req.http.sec-ch-ua-model, 0, 128);\n        set bereq.http.sec-ch-ua-platform = substr(req.http.sec-ch-ua-platform, 0, 32);\n        set bereq.http.sec-fetch-dest = substr(req.http.sec-fetch-dest, 0, 32);\n        set bereq.http.sec-fetch-mode = substr(req.http.sec-fetch-mode, 0, 32);\n        set bereq.http.sec-fetch-site = substr(req.http.sec-fetch-site, 0, 64);\n        set bereq.http.sec-fetch-user = substr(req.http.sec-fetch-user, 0, 8);\n        # Truncating Headers - End\n        if (req.http.x-datadome-clientid) {\n            set bereq.http.x-datadome-params:clientid = urlencode(substr(req.http.x-datadome-clientid, 0, 128));\n            set bereq.http.x-datadome-x-set-cookie = \"true\";\n        } else {\n            set bereq.http.x-datadome-params:clientid = urlencode(substr(req.http.cookie:datadome, 0, 128));\n        }\n        set bereq.http.x-datadome-params:cookieslen = std.strlen(req.http.cookie);\n        # enforce gzip encoding between Fastly and DataDome\n        set bereq.http.accept-encoding = \"gzip\";\n    } else {\n        # prevent leak of the key\n        unset bereq.http.x-datadome-params;\n    }\n  }\n}\n\nbackend datadome {\n    .host = \"api-fastly.datadome.co\";\n    .port = \"8443\";\n    .max_tls_version = \"1.3\";\n    .min_tls_version = \"1.2\";\n    .connect_timeout = {{datadome_connect_timeout}}ms;\n    .first_byte_timeout = {{datadome_between_bytes_timeout}}ms;\n    .between_bytes_timeout = {{datadome_between_bytes_timeout}}ms;\n    .max_connections = 200;\n    .ssl = true;\n    .dynamic = true;\n    .probe = {\n        .request = \"HEAD /.well-known/healthcheck-datadome HTTP/1.1\" \"Host: api-fastly.datadome.co\" \"Connection: close\" \"User-Agent: Varnish/fastly (healthcheck)\";\n        .expected_response = 200;\n        .initial = 5;\n        .interval = 2s;\n        .threshold = 1;\n        .timeout = 2s;\n        .window = 5;\n      }\n}",
+      "template": "sub set_origin_header {\n  if (req.backend.is_origin) {\n    if (req.backend == datadome) {\n        # Remove all unexpected headers\n        header.filter_except(bereq, \"x-datadome-params\", \"accept-charset\", \"accept-language\", \"x-requested-with\", \"x-fl-productid\", \"x-flapi-session-id\", \"fastly-orig-accept-encoding\", \"cache-control\", \"client-id\", \"connection\", \"pragma\", \"accept\", \"headers-list\", \"host\", \"origin\", \"server-hostname\", \"server-name\", \"x-forwarded-for\", \"user-agent\", \"referer\", \"request\", \"content-type\", \"from\", \"true-client-ip\", \"via\", \"x-real-ip\", \"sec-ch-device-memory\", \"sec-ch-ua\", \"sec-ch-ua-arch\", \"sec-ch-ua-full-version-list\", \"sec-ch-ua-mobile\", \"sec-ch-ua-model\", \"sec-ch-ua-platform\", \"sec-fetch-dest\", \"sec-fetch-mode\", \"sec-fetch-site\", \"sec-fetch-user\");\n        set bereq.http.x-datadome-params:key = \"{{datadome_api_key}}\";\n        set bereq.http.x-datadome-params:requestmodulename = \"FastlyMagento\";\n        set bereq.http.x-datadome-params:moduleversion = \"2.23.0\";\n        set bereq.http.x-datadome-params:timerequest = time.start.usec;\n        set bereq.http.x-datadome-params:servername = server.identity;\n        set bereq.http.x-datadome-params:serverregion = server.region;\n        set bereq.http.x-datadome-params:ip = urlencode(client.ip);\n        set bereq.http.x-forwarded-proto = urlencode(req.protocol);\n        set bereq.http.x-datadome-params:authorizationlen = std.strlen(req.http.authorization);\n        # Truncating Headers - Start\n        set bereq.http.accept-charset = substr(req.http.accept-charset, 0, 128);\n        set bereq.http.accept-language = substr(req.http.accept-language, 0, 256);\n        set bereq.http.x-requested-with = substr(req.http.x-requested-with, 0, 128);\n        set bereq.http.x-fl-productid = substr(req.http.x-fl-productid, 0, 64);\n        set bereq.http.x-flapi-session-id = substr(req.http.x-flapi-session-id, 0, 64);\n        set bereq.http.fastly-orig-accept-encoding = substr(req.http.fastly-orig-accept-encoding, 0, 128);\n        set bereq.http.cache-control = substr(req.http.cache-control, 0, 128);\n        set bereq.http.client-id = substr(req.http.client-id, 0, 128);\n        set bereq.http.connection = substr(req.http.connection, 0, 128);\n        set bereq.http.pragma = substr(req.http.pragma, 0, 128);\n        set bereq.http.accept = substr(req.http.accept, 0, 512);\n        set bereq.http.headers-list = substr(req.http.headers-list, 0, 512);\n        set bereq.http.host = substr(req.http.host, 0, 512);\n        set bereq.http.origin = substr(req.http.origin, 0, 512);\n        set bereq.http.server-hostname = substr(req.http.server-hostname, 0, 512);\n        set bereq.http.server-name = substr(req.http.server-name, 0, 512);\n        if( std.strlen(req.http.x-forwarded-for) \u003e 512 ) {\n            # Truncate from the end\n            set bereq.http.x-forwarded-for = substr(req.http.x-forwarded-for, -512);\n        } else {\n            set bereq.http.x-forwarded-for = req.http.x-forwarded-for;\n        }\n        set bereq.http.user-agent = substr(req.http.user-agent, 0, 768);\n        set bereq.http.referer = substr(req.http.referer, 0, 1024);\n        set bereq.http.request = substr(req.http.request, 0, 2048);\n        set bereq.http.content-type = substr(req.http.content-type, 0, 64);\n        set bereq.http.from = substr(req.http.from, 0, 128);\n        set bereq.http.true-client-ip = substr(req.http.true-client-ip, 0, 128);\n        set bereq.http.via = substr(req.http.via, 0, 256);\n        set bereq.http.x-real-ip = substr(req.http.x-real-ip, 0, 128);\n        set bereq.http.sec-ch-device-memory = substr(req.http.sec-ch-device-memory, 0, 8);\n        set bereq.http.sec-ch-ua = substr(req.http.sec-ch-ua, 0, 128);\n        set bereq.http.sec-ch-ua-arch = substr(req.http.sec-ch-ua-arch, 0, 16);\n        set bereq.http.sec-ch-ua-full-version-list = substr(req.http.sec-ch-ua-full-version-list, 0, 256);\n        set bereq.http.sec-ch-ua-mobile = substr(req.http.sec-ch-ua-mobile, 0, 8);\n        set bereq.http.sec-ch-ua-model = substr(req.http.sec-ch-ua-model, 0, 128);\n        set bereq.http.sec-ch-ua-platform = substr(req.http.sec-ch-ua-platform, 0, 32);\n        set bereq.http.sec-fetch-dest = substr(req.http.sec-fetch-dest, 0, 32);\n        set bereq.http.sec-fetch-mode = substr(req.http.sec-fetch-mode, 0, 32);\n        set bereq.http.sec-fetch-site = substr(req.http.sec-fetch-site, 0, 64);\n        set bereq.http.sec-fetch-user = substr(req.http.sec-fetch-user, 0, 8);\n        # Truncating Headers - End\n        if (req.http.x-datadome-clientid) {\n            set bereq.http.x-datadome-params:clientid = urlencode(substr(req.http.x-datadome-clientid, 0, 128));\n            set bereq.http.x-datadome-x-set-cookie = \"true\";\n        } else {\n            set bereq.http.x-datadome-params:clientid = urlencode(substr(req.http.cookie:datadome, 0, 128));\n        }\n        set bereq.http.x-datadome-params:cookieslen = std.strlen(req.http.cookie);\n        # enforce gzip encoding between Fastly and DataDome\n        set bereq.http.accept-encoding = \"gzip\";\n        # disable ng-waf inspection on DataDome requests\n        set bereq.http.x-sigsci-no-inspection = \"true\";\n    } else {\n        # prevent leak of the key\n        unset bereq.http.x-datadome-params;\n    }\n  }\n}\n\nbackend datadome {\n    .host = \"api-fastly.datadome.co\";\n    .port = \"8443\";\n    .max_tls_version = \"1.3\";\n    .min_tls_version = \"1.2\";\n    .connect_timeout = {{datadome_connect_timeout}}ms;\n    .first_byte_timeout = {{datadome_between_bytes_timeout}}ms;\n    .between_bytes_timeout = {{datadome_between_bytes_timeout}}ms;\n    .max_connections = 200;\n    .ssl = true;\n    .dynamic = true;\n    .probe = {\n        .request = \"HEAD /.well-known/healthcheck-datadome HTTP/1.1\" \"Host: api-fastly.datadome.co\" \"Connection: close\" \"User-Agent: Varnish/fastly (healthcheck)\";\n        .expected_response = 200;\n        .initial = 5;\n        .interval = 2s;\n        .threshold = 1;\n        .timeout = 2s;\n        .window = 5;\n      }\n}",
       "type": "init"
     },
     {
@@ -102,5 +102,5 @@
       "type": "pass"
     }
   ],
-  "version": "2.22.0"
+  "version": "2.23.0"
 }