Bot Protect Break Phone Apps

[DarkJackal87]

Hello!

I'm using Safeline with great satisfaction, i just want to know if there is a way to avoid phone apps to break when configuring them with Bot Protect (like Paperless, as soon i turn on Bot Protection the app cannot connect to the service)

Thanks!

[jmrplens]

Yes: the app is not failing the challenge, it never gets to take it, and the Bot Protect dialog of the application has a condition for exactly this case.

With Anti-Bot Challenge on, every request that has not passed the challenge yet gets HTTP 468 with the challenge page, about 15 KB of HTML, whatever the path or the User-Agent. A browser runs that page's script and comes back with a cookie. An app that expects JSON from /api/... gets HTML with status 468 instead and reports that it cannot connect. Measured on SafeLine 9.4.1 with a test upstream behind it.

The fix is in the same dialog where the challenge was turned on. Applications, the app's card, BOT Protect: once Anti-Bot Challenge is checked, a "Challenge Conditions" checkbox appears. Tick it, pick "Skip challenge when the condition is met", and add Match Target "URL Path", Operator "Starts With", Content /api/. Save. Paperless Mobile talks to the server only through /api/ (/api/token/ to log in, /api/profile/, /api/documents/), so that one condition covers it.

Measured after saving, same 9.4.1:

request	before	after
GET / from the app	468, challenge page	468, challenge page
GET /api/... from the app	468, challenge page	200, the upstream's JSON
GET /api/... from a browser	468, challenge page	200

The web UI is not affected: the browser still takes the challenge on the first page load, and the API stays behind Paperless's own login, since the challenge was never authentication. Attack detection stays on for the skipped requests too: an SQL injection probe sent to /api/ under this condition got SafeLine's 403 block page.

If you would rather not skip the challenge for the whole API, the app can identify itself instead. Paperless Mobile's login form has "Additional Headers", sent with every request, so add one there, say X-Paperless-Client: mobile, and use Match Target "Req Headers", Header Field X-Paperless-Client, Equals, mobile as the skip condition. Measured: with that header the app's requests pass on every path, without it they still get 468. Matching on User-Agent would not work here, since the app sends none of its own, only Dart's default.

A global Allow rule (Allow & Deny, Custom Rules, Whitelist, Add rules, Allow) matching the client also lets the app through, but an allow rule skips attack detection as well: the same injection probe reached the upstream with a 200 under one, created with "Continue to detect and log attack requests even when whitelisting." left unticked, which is the default. The per-application condition only skips the challenge, which is why I would start there.

[DarkJackal87]

Hey there! Thanks for the heads up, it works great with Paperless, now the problem it's that i need to do the same with Home Assistant and Jellyfin, the thing is... how i can find the URL that is used also by those phone apps and add this challenge skip? thanks really for the help!

[DarkJackal87]

NVM, i'm using the access log feature to find what give 468 on request, thanks again your post brought me to the right direction