using .NET client SDK always return "Value cannot be null. Parameter name: value" error about flagsmith-dotnet-client HOT 12 CLOSED

It looks like that 403 response is coming directly from the AWS ELB and not the Bullet Train app server. We do offer enterprise support packages for self hosted deployments if that is of interest?

from flagsmith-dotnet-client.

We figured it out. There's a rule entitled, NoUserAgent_HEADER in the AWSManagedCommonRuleSet core rule set for AWS web application firewall (WAF): https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-list.html#aws-managed-rule-groups-baseline

We have excluded the rule for now to allow for Bullet Train traffic, but ideally Bullet Train would use a User-Agent header to ensure we can prevent malicious web requests (and be compliant with the AWS WAF's most used rule set).

from flagsmith-dotnet-client.

Ah understood - that makes sense. I'll add a ticket to have SDK clients send user agents.

from flagsmith-dotnet-client.

Thanks for the bug report - we'll take a look!

from flagsmith-dotnet-client.

@malah-code are you able to reproduce this against the official hosted API?

from flagsmith-dotnet-client.

@dabeeeenster , Thanks for fast reply. I tested it with https://api.bullet-train.io/api/v1/ and it works. so are there any configs I miss in my own server setup? are there any security/firewall things I should do?

from flagsmith-dotnet-client.

its hard to say without knowing exactly what your setup looks like. What version of the API are you running?

from flagsmith-dotnet-client.

Not sure where could I get the version

from flagsmith-dotnet-client.

Will make a point of adding version info to the API. Can you describe how you are running the API? Docker etc?

from flagsmith-dotnet-client.

AWS Container.
Also I noticed that for the same request if I add User-Agent: sdfsdf , it work fine, but without User-Agent return 403 Forbidden

GET https://features.xyz.ca/api/v1/flags/ HTTP/1.1
X-Environment-Key: xyzxyzxyzxyzxyzxyzxyzxyzxyzxyzxy
User-Agent: sdfsdf
Host: features.xyz.ca

from flagsmith-dotnet-client.

I'm not able to reproduce this Im afraid. Are you able to provide the exact two curl commands; 1 that fails and 1 that works?

from flagsmith-dotnet-client.

Here are both requests

from flagsmith-dotnet-client.