Skip to content

Conversation

@hansott
Copy link
Member

@hansott hansott commented Dec 23, 2025

Summary by Aikido

⚡ Enhancements

  • Short-circuited middleware, route, and DNS checks for bypassed IPs
  • Removed bypass-IP exemption so rate limits applied to bypasses
  • Included IPv4-mapped IPv6 addresses when initializing bypassed IP lists
  • Updated QA workflow to use firewall-tester-action version v1.0.4

🔧 Refactors

  • Changed inspection to skip attack detection when forceProtectionOff set

We did the check specifically for rate limiting but not yet for blocked
user IDs.
In c12ee52 we've changed that we check
this flag after inspecting args of an instrumented function

For HTTP clients this means that we'll still call
`agent.onConnectHostname(url.hostname, port);`

And `agent.getConfig().shouldBlockOutgoingRequest(url.hostname)` too

Blocking of new outbound connections should always work, doesn't matter
if the route protection was disabled
So that `onRequest` will always be called

Mistake in f22feb8
`Your IP address is not allowed to access this resource. (Your IP: 1.3.2.2)`
);
t.same(resp3.status, 200);
t.match(await resp3.text(), "Admin panel");
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So https://github.com/AikidoSec/zen-specs/pull/7/changes is obsolete? I still think it is confusing 😅

@amaliarodriguezguevara-dotcom amaliarodriguezguevara-dotcom mentioned this pull request Dec 28, 2025
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants