Lots of FP from apple imessages about fake-bot-plugin HOT 7 CLOSED

@feanorknd Hi. Blocking User-Agent like facebookexternalhit/1.1 Facebot Twitterbot/1.0 doesn't seems to be a FP. Software you are using is obviously broken.

from fake-bot-plugin.

Hi @azurit

this is the user-agent being registered for some requests at nginx logs, and this user-agent is triggering the last version of fakebot plugin configured and installed with modsecurity v4, so rule 9504110 is denying because of the user agent.

If you research a bit, you may see this user agent is commonly used by some apple applications (search for imessages too).

As it contains words reserved for affected robots, lua is performing its checks. ;)
SecRule REQUEST_HEADERS:User-Agent "@pm amazonbot applebot bingbot linkedinbot facebookbot facebookcatalog facebookexternalhit googlebot twitterbot" \

Regards

from fake-bot-plugin.

@feanorknd That software should NOT use such keywords in User-Agent header. It is simply fakeing itself for both Facebook bot and Twitter bot at the same time. This is exactly what Fake Bot Plugin is supposed to block.

from fake-bot-plugin.

It's a stupid situation and the plugin is probably in a very weak situation to make a judgement on a legitimacy of an Apple product claiming to be Facebook. But honestly, the Apple product seems to be giving out wrong information about it's identity and this plugin was designed to detect such anomalies.

The fact that Apple is affected does not make the false claim any better.

Did you open an issue with Apple?

If we get a response from Apple with a technical reason why it's OK to submit this UA in this situation, then we're happy to reconsider. But until then I do not see us changing the plugin.

What you can do it creating a rule exclusion for this situation. Do you need help with that.

from fake-bot-plugin.

Apple sucks, nothing new under the sun.. hehehe

Well, I am just a sysadmin using your excellent plugin, but facing this problem with legit requests... Will just create an exclusion for this user-agent better than disabling.... you are certain ;)

Thanks!

from fake-bot-plugin.

@feanorknd Thank you, closing this issue!

from fake-bot-plugin.

Sounds like a plan. And sorry for the inconvenience.

from fake-bot-plugin.