@AstralDestiny commented on GitHub (May 11, 2026):
I mean in your image that ?_rsc=1j2gm is not part of pangolin so someone's trying to hit that odd path.. if it's part of pangolin I don't think I've ever seen it before..
If it is where are you and what are you doing at the time of being blocked?
<!-- gh-comment-id:4424973533 -->
@AstralDestiny commented on GitHub (May 11, 2026):
I mean in your image that ``?_rsc=1j2gm`` is not part of pangolin so someone's trying to hit that odd path.. if it's part of pangolin I don't think I've ever seen it before..
If it is where are you and what are you doing at the time of being blocked?
I mean in your image that ?_rsc=1j2gm is not part of pangolin so someone's trying to hit that odd path.. if it's part of pangolin I don't think I've ever seen it before..
If it is where are you and what are you doing at the time of being blocked?
when i try visit the public/private resource i will get blocked. i have roll back 1.17.1 and without false ban.
<!-- gh-comment-id:4425021690 -->
@DKT69 commented on GitHub (May 11, 2026):
> I mean in your image that `?_rsc=1j2gm` is not part of pangolin so someone's trying to hit that odd path.. if it's part of pangolin I don't think I've ever seen it before..
>
> If it is where are you and what are you doing at the time of being blocked?
when i try visit the public/private resource i will get blocked. i have roll back 1.17.1 and without false ban.
@LaurenceJJones commented on GitHub (May 11, 2026):
The explain isn't enough context as stated in discord if you have the alert ID then run cscli alert inspect <ID> -d then it will inform of all paths
Sorry if I presumed your the same person but I think I saw the same discord notification image
<!-- gh-comment-id:4425244069 -->
@LaurenceJJones commented on GitHub (May 11, 2026):
The explain isn't enough context as stated in discord if you have the alert ID then run `cscli alert inspect <ID> -d` then it will inform of all paths
Sorry if I presumed your the same person but I think I saw the same discord notification image
@LaurenceJJones commented on GitHub (May 13, 2026):
i see have latest 1.18.4 out have solve this problem?
No, the problem or not so is basically loading the resource page now loads lots of items to get different statuses on the resource itself. Because it seems you have a lot of them it will amplify how many requests are sent during the page load.
I can supply a whitelist file for crowdsec to basically nullify these calls because in theory anything other a 401/403 for pangolin should just be ignored.
<!-- gh-comment-id:4443404597 -->
@LaurenceJJones commented on GitHub (May 13, 2026):
> i see have latest 1.18.4 out have solve this problem?
No, the _problem_ or not so is basically loading the resource page now loads lots of items to get different statuses on the resource itself. Because it seems you have a lot of them it will amplify how many requests are sent during the page load.
I can supply a whitelist file for crowdsec to basically nullify these calls because in theory anything other a 401/403 for pangolin should just be ignored.
i see have latest 1.18.4 out have solve this problem?
No, the problem or not so is basically loading the resource page now loads lots of items to get different statuses on the resource itself. Because it seems you have a lot of them it will amplify how many requests are sent during the page load.
I can supply a whitelist file for crowdsec to basically nullify these calls because in theory anything other a 401/403 for pangolin should just be ignored.
can i get the sample of whitelist?
<!-- gh-comment-id:4443434066 -->
@DKT69 commented on GitHub (May 13, 2026):
> > i see have latest 1.18.4 out have solve this problem?
>
> No, the _problem_ or not so is basically loading the resource page now loads lots of items to get different statuses on the resource itself. Because it seems you have a lot of them it will amplify how many requests are sent during the page load.
>
> I can supply a whitelist file for crowdsec to basically nullify these calls because in theory anything other a 401/403 for pangolin should just be ignored.
can i get the sample of whitelist?
@LaurenceJJones commented on GitHub (May 14, 2026):
So ill provide two whitelist and you can decide how "lax" you want it for me personally anything thats a 200 from Pangolin itself should just be ignored.
# config/crowdsec/parsers/s02-enrich/my-whitelist.yamlname:me/pangolin-whitelistdescription:"Whitelist events from pangolin"filter:"evt.Meta.service == 'http' && evt.Meta.log_type in ['http_access-log', 'http_error-log']"whitelist:reason:"Pangolin Whitelist"expression:- "evt.Meta.traefik_router_name in ['api-router@file', 'next-router@file'] && evt.Meta.http_status not in ['400', '401', '403']"## Whitelist pangolin router names and ignore everything but 400, 401 and 403 status codes
then you could be a little more restrictive but then you could battle with finding the right balance
# config/crowdsec/parsers/s02-enrich/my-whitelist.yamlname:me/pangolin-whitelistdescription:"Whitelist events from pangolin"filter:"evt.Meta.service == 'http' && evt.Meta.log_type in ['http_access-log', 'http_error-log'] && evt.Meta.http_status not in ['400', '401', '403']"whitelist:reason:"Pangolin Whitelist"expression:- "evt.Meta.traefik_router_name == 'api-router@file' && evt.Meta.http_path matches '/api/v1/org/*/certificate/'"- "evt.Meta.traefik_router_name == 'next-router@file' && && evt.Meta.http_path matches '/*/settings/resources/proxy/'"
in my opinion the first is enough, any valid users will be ignored and any unauthenticated requests will still be monitored
<!-- gh-comment-id:4449622613 -->
@LaurenceJJones commented on GitHub (May 14, 2026):
So ill provide two whitelist and you can decide how "lax" you want it for me personally anything thats a 200 from Pangolin itself should just be ignored.
```yaml
# config/crowdsec/parsers/s02-enrich/my-whitelist.yaml
name: me/pangolin-whitelist
description: "Whitelist events from pangolin"
filter: "evt.Meta.service == 'http' && evt.Meta.log_type in ['http_access-log', 'http_error-log']"
whitelist:
reason: "Pangolin Whitelist"
expression:
- "evt.Meta.traefik_router_name in ['api-router@file', 'next-router@file'] && evt.Meta.http_status not in ['400', '401', '403']"
## Whitelist pangolin router names and ignore everything but 400, 401 and 403 status codes
```
then you could be a little more restrictive but then you could battle with finding the right balance
```yaml
# config/crowdsec/parsers/s02-enrich/my-whitelist.yaml
name: me/pangolin-whitelist
description: "Whitelist events from pangolin"
filter: "evt.Meta.service == 'http' && evt.Meta.log_type in ['http_access-log', 'http_error-log'] && evt.Meta.http_status not in ['400', '401', '403']"
whitelist:
reason: "Pangolin Whitelist"
expression:
- "evt.Meta.traefik_router_name == 'api-router@file' && evt.Meta.http_path matches '/api/v1/org/*/certificate/'"
- "evt.Meta.traefik_router_name == 'next-router@file' && && evt.Meta.http_path matches '/*/settings/resources/proxy/'"
```
in my opinion the first is enough, any valid users will be ignored and any unauthenticated requests will still be monitored
@LaurenceJJones commented on GitHub (May 15, 2026):
Will class as completed, we already noted internally we should optimize the fetching of certs and statuses but is a low priority item as the above is a workaround.
remember crowdsec is a separate product, when installing you agreed that you will maintain it yourself so in future we may not aid like this.
<!-- gh-comment-id:4458222360 -->
@LaurenceJJones commented on GitHub (May 15, 2026):
Will class as completed, we already noted internally we should optimize the fetching of certs and statuses but is a low priority item as the above is a workaround.
remember _crowdsec_ is a separate product, when installing you agreed that you will maintain it yourself so in future we may not aid like this.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @DKT69 on GitHub (May 11, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/3054
Describe the Bug
after upgrade from 1.17.1 to 1.18.3 crowdsec false ban with http-crawl-non-statics.
Environment
To Reproduce
Expected Behavior
@AstralDestiny commented on GitHub (May 11, 2026):
I mean in your image that
?_rsc=1j2gmis not part of pangolin so someone's trying to hit that odd path.. if it's part of pangolin I don't think I've ever seen it before..If it is where are you and what are you doing at the time of being blocked?
@DKT69 commented on GitHub (May 11, 2026):
when i try visit the public/private resource i will get blocked. i have roll back 1.17.1 and without false ban.
@AstralDestiny commented on GitHub (May 11, 2026):
Settings or the resource itself?
@LaurenceJJones commented on GitHub (May 11, 2026):
The explain isn't enough context as stated in discord if you have the alert ID then run
cscli alert inspect <ID> -dthen it will inform of all pathsSorry if I presumed your the same person but I think I saw the same discord notification image
@DKT69 commented on GitHub (May 12, 2026):
yes correct that was me same person.
@DKT69 commented on GitHub (May 13, 2026):
i see have latest 1.18.4 out have solve this problem?
@LaurenceJJones commented on GitHub (May 13, 2026):
No, the problem or not so is basically loading the resource page now loads lots of items to get different statuses on the resource itself. Because it seems you have a lot of them it will amplify how many requests are sent during the page load.
I can supply a whitelist file for crowdsec to basically nullify these calls because in theory anything other a 401/403 for pangolin should just be ignored.
@DKT69 commented on GitHub (May 13, 2026):
can i get the sample of whitelist?
@AstralDestiny commented on GitHub (May 13, 2026):
Give Loz a bit to make it. They'll likely post it when it's ready
@LaurenceJJones commented on GitHub (May 14, 2026):
So ill provide two whitelist and you can decide how "lax" you want it for me personally anything thats a 200 from Pangolin itself should just be ignored.
then you could be a little more restrictive but then you could battle with finding the right balance
in my opinion the first is enough, any valid users will be ignored and any unauthenticated requests will still be monitored
@LaurenceJJones commented on GitHub (May 15, 2026):
Will class as completed, we already noted internally we should optimize the fetching of certs and statuses but is a low priority item as the above is a workaround.
remember crowdsec is a separate product, when installing you agreed that you will maintain it yourself so in future we may not aid like this.