Alert ID in AppSec response to bouncers
kind/enhancementneeds/triage
### What would you like to be added?
/kind enhancement
Add alert ID to response body sent from AppSec to bouncers
### Why is this needed?
As per [documentation](https://docs.crowdsec.net/docs/appsec/protocol) AppSec's body will contain only `action` and `http_status` in case of block, but nothing else. When a bouncer (at least Caddy one) intercepts a _decision_ - it can get a decision ID and then pass it down to whatever extra processing, if required (like I was able to do in this PR for Caddy bouncer https://github.com/hslatman/caddy-crowdsec-bouncer/pull/125). But if block was done by AppSec - there is no such luck, and it may be very difficult to get any information about why a request was blocked, especially if it's done a few hours or even days later (like a user reported a false positive). We even have an example of it in https://github.com/crowdsecurity/crowdsec/issues/4518 Having Alert ID gives an option of further processing or, at least, extra logging, to help debug things later.
关闭于 2026-07-02 8 条评论