Post by @jorijn

Jorijn Schrijvershof
@jorijn
Public en

Was greeted this morning by monitoring notifying me of crashing web containers throughout the night.

Root cause: distributed /media_proxy flood where clients request the entire srcset attribute as a URL (%20 + ,%20https:/.../small%20...w). At peak: 23,298 unique IPs per 5 min + lots of 499/503.

Mitigated via CrowdSec trigger on Traefik logs (path-based): https://github.com/toot-community/platform/commit/183ddfff3b70c8bf4b168cda52f84e6e3bf942de

This detection logic should apply to any WAF, though.

FYI #mastoadmin