[GH-ISSUE #3101] Dashboard triggers a flood of parallel API calls, causing CrowdSec to ban the client IP (http-crawl-non_statics) #23606

New Issue

Closed

opened 2026-06-05 06:34:15 -05:00 by GiteaMirror · 1 comment

GiteaMirror commented 2026-06-05 06:34:15 -05:00

Owner

Copy Link

Copy Source

Originally created by @Vigno04 on GitHub (May 17, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/3101

Describe the Bug

When a user navigates to the Settings > Resources or proxy dashboard page (/settings/resources/proxy), the React/Next.js frontend client aggressively launches a massive flood of parallel client-side API requests to fetch individual certificate verifications, configuration details, and historical status logs for every single configured proxy (e.g. GET /api/v1/resource/{id}/status-history?days=30, GET /api/v1/org/{org}/certificate/domain1/{domain}, GET /settings/resources/proxy/{name}?_rsc=...).

For administrators running Pangolin behind a standard CrowdSec setup (with the default crowdsecurity/http-crawl-non_statics scenario enabled), this extreme spike of parallel requests to dynamic paths is flagged as an aggressive automated scanner or crawler. Consequently, CrowdSec immediately bans the administrator's IP address, completely locking them out of the Pangolin dashboard and all other proxy-hosted services with a 403 Forbidden error.

During a single load of this page, our Traefik access log recorded 119 successful dynamic GET requests in under 60 seconds from the client's browser, with bursts exceeding 25+ requests in a single second.

Environment

• OS Type & Version: Ubuntu 24.04.4 LTS (Noble Numbat)
• Pangolin Version: Enterprise Edition (fosrl/pangolin:ee-latest)
• Gerbil Version: fosrl/gerbil:latest
• Traefik Version: traefik:v3.5

To Reproduce

Steps to reproduce the behavior:

1. Deploy a standard Pangolin stack with Traefik and CrowdSec enabled (specifically running the crowdsecurity/http-crawl-non_statics parser scenario).
2. Configure a moderate to large list of proxy resources (e.g., 20 to 30 proxies).
3. Log in to the Pangolin dashboard.
4. Navigate to the Settings > Resources > Proxies page.
5. The request rate immediately fills CrowdSec's standard leaky bucket threshold (which has a default capacity of 40 and a leak rate of 0.5 seconds / 2 requests per second).
6. Refresh the page or click around. Your IP address gets banned, resulting in a sudden 403 Forbidden error on all subsequent requests.

Expected Behavior

The dashboard page should load lists of resources in a rate-limited or batched manner, rather than launching an unrestricted deluge of concurrent client-side requests:

Originally created by @Vigno04 on GitHub (May 17, 2026). Original GitHub issue: https://github.com/fosrl/pangolin/issues/3101 ### Describe the Bug When a user navigates to the Settings > Resources or proxy dashboard page (/settings/resources/proxy), the React/Next.js frontend client aggressively launches a massive flood of parallel client-side API requests to fetch individual certificate verifications, configuration details, and historical status logs for every single configured proxy (e.g. GET /api/v1/resource/{id}/status-history?days=30, GET /api/v1/org/{org}/certificate/domain1/{domain}, GET /settings/resources/proxy/{name}?_rsc=...). For administrators running Pangolin behind a standard CrowdSec setup (with the default crowdsecurity/http-crawl-non_statics scenario enabled), this extreme spike of parallel requests to dynamic paths is flagged as an aggressive automated scanner or crawler. Consequently, CrowdSec immediately bans the administrator's IP address, completely locking them out of the Pangolin dashboard and all other proxy-hosted services with a 403 Forbidden error. During a single load of this page, our Traefik access log recorded 119 successful dynamic GET requests in under 60 seconds from the client's browser, with bursts exceeding 25+ requests in a single second. ### Environment - OS Type & Version: Ubuntu 24.04.4 LTS (Noble Numbat) - Pangolin Version: Enterprise Edition (fosrl/pangolin:ee-latest) - Gerbil Version: fosrl/gerbil:latest - Traefik Version: traefik:v3.5 ### To Reproduce Steps to reproduce the behavior: 1. Deploy a standard Pangolin stack with Traefik and CrowdSec enabled (specifically running the crowdsecurity/http-crawl-non_statics parser scenario). 2. Configure a moderate to large list of proxy resources (e.g., 20 to 30 proxies). 3. Log in to the Pangolin dashboard. 4. Navigate to the Settings > Resources > Proxies page. 5. The request rate immediately fills CrowdSec's standard leaky bucket threshold (which has a default capacity of 40 and a leak rate of 0.5 seconds / 2 requests per second). 6. Refresh the page or click around. Your IP address gets banned, resulting in a sudden 403 Forbidden error on all subsequent requests. ### Expected Behavior The dashboard page should load lists of resources in a rate-limited or batched manner, rather than launching an unrestricted deluge of concurrent client-side requests:

GiteaMirror closed this issue 2026-06-05 06:34:16 -05:00

GiteaMirror commented 2026-06-05 06:34:18 -05:00

Author

Owner

Copy Link

Copy Source

@LaurenceJJones commented on GitHub (May 18, 2026):

https://github.com/fosrl/pangolin/issues/3054

Please see above, as per installation agreement you will look after the crowdsec side.

Yes we can and will improve the api calls but for now you must use an expression whitelist.

<!-- gh-comment-id:4475147806 --> @LaurenceJJones commented on GitHub (May 18, 2026): https://github.com/fosrl/pangolin/issues/3054 Please see above, as per installation agreement you will look after the crowdsec side. Yes we can and will improve the api calls but for now you must use an expression whitelist.

Sign in to join this conversation.

No Branch/Tag Specified

Branches Tags

main

dependabot/docker/docker-dependencies-4faa477378

dependabot/npm_and_yarn/body-parser-2.3.0

refactor/batch-status-requests

dependabot/npm_and_yarn/npm-dependencies-8b2d4a9f3a

dependabot/go_modules/install/go-install-dependencies-3804ca7238

dev

dependabot/npm_and_yarn/axios-1.18.0

crowdin_dev

fix/labels-dropdown-flicker

dependabot/github_actions/github-actions-dependencies-2ee11778c9

feat/remember-last-idp-on-smart-login-form

dependabot/npm_and_yarn/multi-5f1280885e

fix/non-semver-version-error

private-resource-page

resource-launcher

backhaul

exit-node-reconnect

feat/command-palette

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

1.21.0

1.21.0-rc.0

1.20.0

1.20.0-rc.0

1.19.4

1.19.3

1.19.2

1.19.1

1.19.0

1.19.0-rc.1

1.19.0-rc.0

1.18.4

1.18.3

1.18.2

1.18.1

1.18.0

1.18.0-rc.0

1.17.1

1.17.0

1.17.0-rc.0

1.16.2

1.16.1

1.16.0

1.16.0-rc.0

1.15.4

1.15.3

1.15.2

1.15.1

1.15.0

1.15.0-rc.0

1.14.1

1.14.0

1.14.0-rc.0

1.13.1

1.13.0

1.13.0-rc.0

1.12.3

1.12.2

1.12.1

1.12.0

1.12.0-rc.0

1.11.1

1.11.0

1.10.3

1.10.2

1.10.1

1.10.0

1.9.4

1.9.3

1.9.2

1.9.1

1.9.0

1.8.0

1.7.3

1.7.2

1.7.1

1.7.0

1.6.2

1.6.1

1.6.0

1.5.1

1.5.0

1.4.0

1.3.2

1.3.1

1.3.0

1.2.0

1.1.0

1.0.1

1.0.0

1.0.0-beta.15

1.0.0-beta.14

1.0.0-beta.13

1.0.0-beta.12

1.0.0-beta.11

1.0.0-beta.10

1.0.0-beta.9

1.0.0-beta.8

1.0.0-beta.7

1.0.0-beta.6

1.0.0-beta.5

1.0.0-beta.4

1.0.0-beta.3

1.0.0-beta.2

1.0.0-beta.1

Labels

Clear labels

api

authentication

bug

config

dependencies

docker

documentation

enhancement

good first issue

help wanted

Improvement

Look Into

needs investigating

networking

new feature

non-critical bug

potential bug

pull-request

Mirrored from GitHub Pull Request

question

reverse proxy

Security

stale

ui

wontfix

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

GiteaMirror ninjasurge (Kaehlen Rog)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/pangolin#23606