feat: add waf bypass prevention rule

[alehostert]

We could have a toggle to add a WAF Bypass Prevention nginx rule for major companies, like NOC.org, Sucuri, Akamai, etc.

I have this code block working fine with NOC:

# WAF Bypass Prevention
# With WebSockets support
set $bypass_attempt "deny";

if ($http_upgrade ~* websocket)                                 { set $bypass_attempt "allow"; } # WebSocket handshake
if ($request_uri ~ ^/(ws|websocket)/)                           { set $bypass_attempt "allow"; } # General WebSocket
if ($request_uri ~ /socket\.io/.*transport=(polling|websocket)) { set $bypass_attempt "allow"; } # Socket.IO

if ($http_x_real_ip = "")        { set $bypass_attempt "${bypass_attempt}_1"; }
if ($http_noc_cdn_location = "") { set $bypass_attempt "${bypass_attempt}_2"; }

if ($bypass_attempt = "deny_1")   { return 403; }
if ($bypass_attempt = "deny_2")   { return 403; }
if ($bypass_attempt = "deny_1_2") { return 403; }

Just adding this to location / on /app/conf/nginx/mapping/primary.conf works.

[ntorga]

Right, but that's entirely based on HTTP headers which can be manipulated easily. I'll add a default/pre-seeded security rule on mappings that can be used to restrict limit to Sucuri, NOC and CloudFlare. About the websocket, it's best if the person uses a subdomain for that or add a ws/websocket mapping without the security rule to allow for a bypass.