Add Security Response ID #10133
Open
Add Security Response ID #10133
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jandro996
added
type: enhancement
BenchmarksStartupParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 55 metrics, 10 unstable metrics. Startup time reports for petclinicgantt
title petclinic - global startup overhead: candidate=1.58.0-SNAPSHOT~caa52091a1, baseline=1.58.0-SNAPSHOT~6ccbc0607e
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.086 s) : 0, 1085830
Total [baseline] (10.767 s) : 0, 10767398
Agent [candidate] (1.085 s) : 0, 1084708
Total [candidate] (10.908 s) : 0, 10908305
section appsec
Agent [baseline] (1.264 s) : 0, 1263827
Total [baseline] (10.867 s) : 0, 10866554
Agent [candidate] (1.27 s) : 0, 1270358
Total [candidate] (11.045 s) : 0, 11044553
section iast
Agent [baseline] (1.226 s) : 0, 1225606
Total [baseline] (11.249 s) : 0, 11249451
Agent [candidate] (1.224 s) : 0, 1223935
Total [candidate] (11.215 s) : 0, 11215419
section profiling
Agent [baseline] (1.213 s) : 0, 1213379
Total [baseline] (10.989 s) : 0, 10988754
Agent [candidate] (1.204 s) : 0, 1204245
Total [candidate] (10.86 s) : 0, 10859898
gantt
title petclinic - break down per module: candidate=1.58.0-SNAPSHOT~caa52091a1, baseline=1.58.0-SNAPSHOT~6ccbc0607e
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.192 ms) : 0, 1192
crashtracking [candidate] (1.191 ms) : 0, 1191
BytebuddyAgent [baseline] (653.12 ms) : 0, 653120
BytebuddyAgent [candidate] (651.702 ms) : 0, 651702
GlobalTracer [baseline] (282.394 ms) : 0, 282394
GlobalTracer [candidate] (282.468 ms) : 0, 282468
AppSec [baseline] (32.228 ms) : 0, 32228
AppSec [candidate] (32.173 ms) : 0, 32173
Debugger [baseline] (67.973 ms) : 0, 67973
Debugger [candidate] (67.284 ms) : 0, 67284
Remote Config [baseline] (609.991 µs) : 0, 610
Remote Config [candidate] (609.116 µs) : 0, 609
Telemetry [baseline] (9.019 ms) : 0, 9019
Telemetry [candidate] (9.122 ms) : 0, 9122
Flare Poller [baseline] (3.728 ms) : 0, 3728
Flare Poller [candidate] (4.614 ms) : 0, 4614
section appsec
crashtracking [baseline] (1.18 ms) : 0, 1180
crashtracking [candidate] (1.184 ms) : 0, 1184
BytebuddyAgent [baseline] (689.3 ms) : 0, 689300
BytebuddyAgent [candidate] (694.697 ms) : 0, 694697
GlobalTracer [baseline] (259.047 ms) : 0, 259047
GlobalTracer [candidate] (260.438 ms) : 0, 260438
IAST [baseline] (24.527 ms) : 0, 24527
IAST [candidate] (24.684 ms) : 0, 24684
AppSec [baseline] (173.685 ms) : 0, 173685
AppSec [candidate] (172.566 ms) : 0, 172566
Debugger [baseline] (66.987 ms) : 0, 66987
Debugger [candidate] (67.744 ms) : 0, 67744
Remote Config [baseline] (693.549 µs) : 0, 694
Remote Config [candidate] (695.284 µs) : 0, 695
Telemetry [baseline] (8.992 ms) : 0, 8992
Telemetry [candidate] (8.963 ms) : 0, 8963
Flare Poller [baseline] (3.852 ms) : 0, 3852
Flare Poller [candidate] (3.811 ms) : 0, 3811
section iast
crashtracking [baseline] (1.182 ms) : 0, 1182
crashtracking [candidate] (1.18 ms) : 0, 1180
BytebuddyAgent [baseline] (792.318 ms) : 0, 792318
BytebuddyAgent [candidate] (791.199 ms) : 0, 791199
GlobalTracer [baseline] (256.671 ms) : 0, 256671
GlobalTracer [candidate] (256.087 ms) : 0, 256087
IAST [baseline] (27.041 ms) : 0, 27041
IAST [candidate] (27.063 ms) : 0, 27063
AppSec [baseline] (34.45 ms) : 0, 34450
AppSec [candidate] (33.704 ms) : 0, 33704
Debugger [baseline] (65.855 ms) : 0, 65855
Debugger [candidate] (66.851 ms) : 0, 66851
Remote Config [baseline] (563.236 µs) : 0, 563
Remote Config [candidate] (556.262 µs) : 0, 556
Telemetry [baseline] (8.521 ms) : 0, 8521
Telemetry [candidate] (8.505 ms) : 0, 8505
Flare Poller [baseline] (3.517 ms) : 0, 3517
Flare Poller [candidate] (3.472 ms) : 0, 3472
section profiling
crashtracking [baseline] (1.223 ms) : 0, 1223
crashtracking [candidate] (1.215 ms) : 0, 1215
BytebuddyAgent [baseline] (707.192 ms) : 0, 707192
BytebuddyAgent [candidate] (702.234 ms) : 0, 702234
GlobalTracer [baseline] (222.08 ms) : 0, 222080
GlobalTracer [candidate] (220.828 ms) : 0, 220828
AppSec [baseline] (32.579 ms) : 0, 32579
AppSec [candidate] (32.114 ms) : 0, 32114
Debugger [baseline] (68.428 ms) : 0, 68428
Debugger [candidate] (67.976 ms) : 0, 67976
Remote Config [baseline] (661.138 µs) : 0, 661
Remote Config [candidate] (642.032 µs) : 0, 642
Telemetry [baseline] (9.004 ms) : 0, 9004
Telemetry [candidate] (8.898 ms) : 0, 8898
Flare Poller [baseline] (3.77 ms) : 0, 3770
Flare Poller [candidate] (3.761 ms) : 0, 3761
ProfilingAgent [baseline] (98.289 ms) : 0, 98289
ProfilingAgent [candidate] (96.933 ms) : 0, 96933
Profiling [baseline] (98.884 ms) : 0, 98884
Profiling [candidate] (97.51 ms) : 0, 97510
Startup time reports for insecure-bankgantt
title insecure-bank - global startup overhead: candidate=1.58.0-SNAPSHOT~caa52091a1, baseline=1.58.0-SNAPSHOT~6ccbc0607e
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.08 s) : 0, 1079655
Total [baseline] (8.716 s) : 0, 8716294
Agent [candidate] (1.091 s) : 0, 1090888
Total [candidate] (8.742 s) : 0, 8741941
section iast
Agent [baseline] (1.221 s) : 0, 1220580
Total [baseline] (9.332 s) : 0, 9332154
Agent [candidate] (1.222 s) : 0, 1221919
Total [candidate] (9.299 s) : 0, 9298734
gantt
title insecure-bank - break down per module: candidate=1.58.0-SNAPSHOT~caa52091a1, baseline=1.58.0-SNAPSHOT~6ccbc0607e
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.183 ms) : 0, 1183
crashtracking [candidate] (1.204 ms) : 0, 1204
BytebuddyAgent [baseline] (648.356 ms) : 0, 648356
BytebuddyAgent [candidate] (655.127 ms) : 0, 655127
GlobalTracer [baseline] (282.39 ms) : 0, 282390
GlobalTracer [candidate] (285.081 ms) : 0, 285081
AppSec [baseline] (32.068 ms) : 0, 32068
AppSec [candidate] (32.834 ms) : 0, 32834
Debugger [baseline] (66.821 ms) : 0, 66821
Debugger [candidate] (67.457 ms) : 0, 67457
Remote Config [baseline] (609.942 µs) : 0, 610
Remote Config [candidate] (633.362 µs) : 0, 633
Telemetry [baseline] (9.07 ms) : 0, 9070
Telemetry [candidate] (9.127 ms) : 0, 9127
Flare Poller [baseline] (3.701 ms) : 0, 3701
Flare Poller [candidate] (3.755 ms) : 0, 3755
section iast
crashtracking [baseline] (1.195 ms) : 0, 1195
crashtracking [candidate] (1.189 ms) : 0, 1189
BytebuddyAgent [baseline] (788.722 ms) : 0, 788722
BytebuddyAgent [candidate] (790.663 ms) : 0, 790663
GlobalTracer [baseline] (255.318 ms) : 0, 255318
GlobalTracer [candidate] (256.075 ms) : 0, 256075
IAST [baseline] (27.085 ms) : 0, 27085
IAST [candidate] (27.047 ms) : 0, 27047
AppSec [baseline] (33.63 ms) : 0, 33630
AppSec [candidate] (33.491 ms) : 0, 33491
Debugger [baseline] (66.602 ms) : 0, 66602
Debugger [candidate] (65.585 ms) : 0, 65585
Remote Config [baseline] (609.499 µs) : 0, 609
Remote Config [candidate] (619.525 µs) : 0, 620
Telemetry [baseline] (8.498 ms) : 0, 8498
Telemetry [candidate] (8.384 ms) : 0, 8384
Flare Poller [baseline] (3.532 ms) : 0, 3532
Flare Poller [candidate] (3.494 ms) : 0, 3494
LoadParameters
See matching parameters
SummaryFound 3 performance improvements and 2 performance regressions! Performance is the same for 16 metrics, 15 unstable metrics.
Request duration reports for petclinicgantt
title petclinic - request duration [CI 0.99] : candidate=1.58.0-SNAPSHOT~caa52091a1, baseline=1.58.0-SNAPSHOT~6ccbc0607e
dateFormat X
axisFormat %s
section baseline
no_agent (18.964 ms) : 18774, 19155
. : milestone, 18964,
appsec (18.482 ms) : 18297, 18667
. : milestone, 18482,
code_origins (17.716 ms) : 17539, 17892
. : milestone, 17716,
iast (17.406 ms) : 17232, 17580
. : milestone, 17406,
profiling (18.672 ms) : 18484, 18860
. : milestone, 18672,
tracing (17.813 ms) : 17637, 17988
. : milestone, 17813,
section candidate
no_agent (18.263 ms) : 18078, 18448
. : milestone, 18263,
appsec (18.513 ms) : 18323, 18702
. : milestone, 18513,
code_origins (17.894 ms) : 17715, 18074
. : milestone, 17894,
iast (17.608 ms) : 17430, 17786
. : milestone, 17608,
profiling (18.582 ms) : 18399, 18766
. : milestone, 18582,
tracing (17.593 ms) : 17420, 17766
. : milestone, 17593,
Request duration reports for insecure-bankgantt
title insecure-bank - request duration [CI 0.99] : candidate=1.58.0-SNAPSHOT~caa52091a1, baseline=1.58.0-SNAPSHOT~6ccbc0607e
dateFormat X
axisFormat %s
section baseline
no_agent (1.196 ms) : 1184, 1208
. : milestone, 1196,
iast (3.321 ms) : 3278, 3364
. : milestone, 3321,
iast_FULL (5.986 ms) : 5924, 6047
. : milestone, 5986,
iast_GLOBAL (3.75 ms) : 3681, 3818
. : milestone, 3750,
profiling (1.95 ms) : 1933, 1967
. : milestone, 1950,
tracing (1.828 ms) : 1812, 1843
. : milestone, 1828,
section candidate
no_agent (1.2 ms) : 1188, 1212
. : milestone, 1200,
iast (3.162 ms) : 3125, 3199
. : milestone, 3162,
iast_FULL (5.605 ms) : 5550, 5660
. : milestone, 5605,
iast_GLOBAL (3.682 ms) : 3622, 3742
. : milestone, 3682,
profiling (2.152 ms) : 2133, 2170
. : milestone, 2152,
tracing (2.022 ms) : 2001, 2043
. : milestone, 2022,
DacapoParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 11 metrics, 1 unstable metrics. Execution time for biojavagantt
title biojava - execution time [CI 0.99] : candidate=1.58.0-SNAPSHOT~caa52091a1, baseline=1.58.0-SNAPSHOT~6ccbc0607e
dateFormat X
axisFormat %s
section baseline
no_agent (14.925 s) : 14925000, 14925000
. : milestone, 14925000,
appsec (14.547 s) : 14547000, 14547000
. : milestone, 14547000,
iast (18.247 s) : 18247000, 18247000
. : milestone, 18247000,
iast_GLOBAL (17.716 s) : 17716000, 17716000
. : milestone, 17716000,
profiling (15.251 s) : 15251000, 15251000
. : milestone, 15251000,
tracing (14.597 s) : 14597000, 14597000
. : milestone, 14597000,
section candidate
no_agent (14.783 s) : 14783000, 14783000
. : milestone, 14783000,
appsec (14.825 s) : 14825000, 14825000
. : milestone, 14825000,
iast (18.378 s) : 18378000, 18378000
. : milestone, 18378000,
iast_GLOBAL (17.891 s) : 17891000, 17891000
. : milestone, 17891000,
profiling (15.383 s) : 15383000, 15383000
. : milestone, 15383000,
tracing (14.903 s) : 14903000, 14903000
. : milestone, 14903000,
Execution time for tomcatgantt
title tomcat - execution time [CI 0.99] : candidate=1.58.0-SNAPSHOT~caa52091a1, baseline=1.58.0-SNAPSHOT~6ccbc0607e
dateFormat X
axisFormat %s
section baseline
no_agent (1.473 ms) : 1462, 1485
. : milestone, 1473,
appsec (3.71 ms) : 3492, 3929
. : milestone, 3710,
iast (2.215 ms) : 2149, 2280
. : milestone, 2215,
iast_GLOBAL (2.252 ms) : 2187, 2318
. : milestone, 2252,
profiling (2.054 ms) : 2001, 2107
. : milestone, 2054,
tracing (2.042 ms) : 1991, 2093
. : milestone, 2042,
section candidate
no_agent (1.47 ms) : 1459, 1482
. : milestone, 1470,
appsec (3.653 ms) : 3436, 3869
. : milestone, 3653,
iast (2.211 ms) : 2146, 2276
. : milestone, 2211,
iast_GLOBAL (2.255 ms) : 2189, 2320
. : milestone, 2255,
profiling (2.111 ms) : 2055, 2168
. : milestone, 2111,
tracing (2.04 ms) : 1989, 2091
. : milestone, 2040,
|
Base automatically changed from
alejandro.gonzalez/appsec-block-refactor
to
master
December 11, 2025 15:52
jandro996
force-pushed
the
alejandro.gonzalez/security-response-id
branch
from
8911a23 to
d3c9024
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Comment on lines
60
to
+64
| return new RequestBlockingAction( | ||
| statusCode, BlockingContentType.NONE, Collections.singletonMap("Location", location)); | ||
| statusCode, | ||
| BlockingContentType.NONE, | ||
| Collections.singletonMap("Location", location), | ||
| null); |
There was a problem hiding this comment.
Redirect blocking actions drop the security_response_id even though WAFModule extracts it: RequestBlockingAction.forRedirect(...) always builds the action with a null securityResponseId, so BlockResponseFunction implementations later see a null value and cannot add the identifier to redirect responses. When libddwaf 17.3.0 returns a redirect_request with a generated security_response_id but the Location URL has no placeholder, the ID is lost and the redirect sent to the client lacks the unique identifier the feature is meant to surface.
Useful? React with 👍 / 👎.
|
|
||
| String templateString = new String(template, java.nio.charset.StandardCharsets.UTF_8); | ||
| String replacedTemplate = templateString.replace("[security_response_id]", replacementValue); | ||
| return replacedTemplate.getBytes(java.nio.charset.StandardCharsets.UTF_8); |
There was a problem hiding this comment.
Use imports here please
| def securityResponseId = '12345678-1234-1234-1234-123456789abc' | ||
|
|
||
| when: | ||
| def template = BlockingActionHelper.getTemplate(HTML, securityResponseId) |
There was a problem hiding this comment.
Maybe you can parameterize the tests with a where to reduce the amount of code.
| boolean res = | ||
| blockResponseFunction.tryCommitBlockingResponse( | ||
| reqCtx.getTraceSegment(), statusCode, templateType, extraHeaders); | ||
| reqCtx.getTraceSegment(), statusCode, templateType, extraHeaders, null); |
There was a problem hiding this comment.
Should we expose the block id in the external public API?
Member
Author
There was a problem hiding this comment.
Not sure, is not specified in the RFC, I'm asking other team for their implementations and aiming to specify it in the RFC.
Right now the answer IMHO is no
Member
Author
There was a problem hiding this comment.
Confirmed, we don't want to expose that
| context); | ||
| } | ||
|
|
||
| public static boolean block( |
There was a problem hiding this comment.
Does it make sense to keep the old blocking method without ID?
Member
Author
There was a problem hiding this comment.
No, thanks for the advice!
jandro996
requested review from
Mariovido and
erikayasuda
and removed request for
a team
jandro996
force-pushed
the
alejandro.gonzalez/security-response-id
branch
from
2126d7a to
eae929e
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What Does This Do
This PR adds support for extracting and emitting a unique security_response_id (UUIDv4 format) in AppSec blocking responses, generated by libddwaf
v17.3.0Implementation flow:
WAFModule.java): When libddwaf triggers a blocking action, extract the security_response_id from actionInfo.parameters and pass it to RequestBlockingAction constructorFlow.java): Add securityResponseId field to RequestBlockingAction class with getter method and update all constructors (includingforRedirect()factory method)BlockingActionHelper.java):- Add blockId parameter to
getTemplate()method- Replace
{security_response_id}placeholder in HTML template- Add
security_response_idfield in JSON template- Append
?security_response_id=<uuid>to redirect URLsResult: Blocking responses now include the unique identifier in all response types (JSON, HTML, redirect), enabling customers to track and debug specific blocking events.
Motivation
Per RFC-1070, libddwaf v17.3.0 generates a UUIDv4 as security_response_id in action parameters to provide unique identifiers for each blocking event. This PR implements the required changes:
This enables customers to uniquely identify and track specific blocking events for debugging and analysis.
Additional Notes
Contributor Checklist
type:and (comp:orinst:) labels in addition to any useful labelsclose,fixor any linking keywords when referencing an issue.Use
solvesinstead, and assign the PR milestone to the issueJira ticket: [APPSEC-60242]