README
¶
vpndetect
Flags or blocks sign-ins that arrive over a VPN, an anonymising proxy or a Tor exit node.
It does not do its own network probing. It reads the connection flags that geoip already
resolved and applies your policy to them, so the cost is a map lookup rather than an outbound
call. Tor is blocked by default. VPN and proxy are not, because plenty of legitimate people
use both.
Use it when
- Tor traffic to your auth endpoints is never legitimate and you want it gone
- You're in a regulated space where the origin of a session has to be attributable
- You want the VPN flag recorded on sessions for later investigation, without blocking anything today
Skip it when
- A meaningful share of your users are on a corporate VPN. Blocking that locks out the exact people who pay you
- Privacy-conscious users are your market. Blocking Tor is a product decision, not just a security one
- You are not running
geoip, which is where the flags come from
Wiring
authsome.WithPlugin(vpndetect.New(vpndetect.Config{
BlockTor: true,
BlockVPN: false,
BlockProxy: false,
}))
Leave all three false and the plugin still runs. It records the flags and blocks nothing, which is a reasonable way to find out how much of your traffic this would have caught.
Config
| Field | Type | Default | What it does |
|---|---|---|---|
BlockVPN |
bool |
false |
Refuse connections flagged as VPN |
BlockProxy |
bool |
false |
Refuse connections flagged as an anonymising proxy |
BlockTor |
bool |
true |
Refuse connections from a Tor exit node |
BlockMessage |
string |
empty | Error text returned on a block |
Settings
| Key | Default |
|---|---|
vpndetect.block_vpn |
false |
vpndetect.block_proxy |
false |
vpndetect.block_tor |
true |
vpndetect.block_message |
empty |
Lifecycle hooks
| Hook | What happens |
|---|---|
BeforeSignUp |
Blocks registration from a flagged connection |
BeforeSignIn |
Blocks the sign-in before credentials are checked |
BeforePrincipalAuth |
Same gate for non-user principals |
Related
Requires geoip. Pairs naturally with ipreputation, which scores the address itself rather
than the kind of tunnel it arrived through.
Documentation
¶
Overview ¶
contract.go: Wires the vpndetect plugin into the forge-dashboard contract surface via plugin.ContractContributor.
Package vpndetect provides VPN, proxy, and Tor exit node detection for authentication events. It reads GeoLocation flags from the geoip plugin and optionally blocks or flags suspicious connections.
Index ¶
- Variables
- type Config
- type Plugin
- func (p *Plugin) DeclareSettings(m *settings.Manager) error
- func (p *Plugin) Name() string
- func (p *Plugin) OnBeforePrincipalAuth(ctx context.Context, a *principal.AuthAttempt) error
- func (p *Plugin) OnBeforeSignIn(ctx context.Context, req *account.SignInRequest) error
- func (p *Plugin) OnBeforeSignUp(ctx context.Context, req *account.SignUpRequest) error
- func (p *Plugin) OnInit(_ context.Context, engine plugin.Engine) error
- func (p *Plugin) RegisterContract(d *dispatcher.Dispatcher, reg contract.Registry, wreg contract.WardenRegistry, ...) error
Constants ¶
This section is empty.
Variables ¶
var ( // SettingBlockVPN controls whether VPN connections are blocked. SettingBlockVPN = settings.Define("vpndetect.block_vpn", false, settings.WithDisplayName("Block VPN"), settings.WithDescription("Block authentication attempts from VPN connections"), settings.WithCategory("VPN Detection"), settings.WithScopes(settings.ScopeGlobal, settings.ScopeApp), settings.WithEnforceable(), settings.WithHelpText("Block authentication attempts from VPN connections"), settings.WithOrder(10), ) // SettingBlockProxy controls whether proxy connections are blocked. SettingBlockProxy = settings.Define("vpndetect.block_proxy", false, settings.WithDisplayName("Block Proxy"), settings.WithDescription("Block authentication attempts from proxy connections"), settings.WithCategory("VPN Detection"), settings.WithScopes(settings.ScopeGlobal, settings.ScopeApp), settings.WithEnforceable(), settings.WithHelpText("Block authentication attempts from proxy connections"), settings.WithOrder(20), ) // SettingBlockTor controls whether Tor exit node connections are blocked. SettingBlockTor = settings.Define("vpndetect.block_tor", true, settings.WithDisplayName("Block Tor"), settings.WithDescription("Block authentication attempts from Tor exit nodes"), settings.WithCategory("VPN Detection"), settings.WithScopes(settings.ScopeGlobal, settings.ScopeApp), settings.WithEnforceable(), settings.WithHelpText("Block authentication attempts from Tor exit nodes"), settings.WithOrder(30), ) // SettingBlockMessage is the error message shown when access is blocked. SettingBlockMessage = settings.Define("vpndetect.block_message", "", settings.WithDisplayName("Block Message"), settings.WithDescription("Error message shown when access is blocked due to VPN/proxy/Tor detection"), settings.WithCategory("VPN Detection"), settings.WithScopes(settings.ScopeGlobal, settings.ScopeApp), settings.WithHelpText("Error message shown when access is blocked due to VPN/proxy/Tor detection"), settings.WithPlaceholder("Access denied: VPN or proxy detected"), settings.WithOrder(40), ) )
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
// BlockVPN blocks VPN connections (default: false).
BlockVPN bool
// BlockProxy blocks proxy connections (default: false).
BlockProxy bool
// BlockTor blocks Tor exit node connections (default: true).
BlockTor bool
// BlockMessage is the error message returned on block.
BlockMessage string
}
Config configures the VPN/Proxy/Tor detection plugin.
type Plugin ¶
type Plugin struct {
// contains filtered or unexported fields
}
Plugin detects and optionally blocks VPN/proxy/Tor connections.
func (*Plugin) DeclareSettings ¶
DeclareSettings implements plugin.SettingsProvider. It registers all VPN-detection-related configurable settings.
func (*Plugin) OnBeforePrincipalAuth ¶
OnBeforePrincipalAuth checks the connection type of a machine caller.
The same check sign-in gets. API-key traffic reaches strategy.Authenticate and fires none of the sign-in hooks, so without this a leaked key worked from behind a VPN, proxy or Tor exit node regardless of policy.
func (*Plugin) OnBeforeSignIn ¶
OnBeforeSignIn checks the connection type.
func (*Plugin) OnBeforeSignUp ¶
OnBeforeSignUp checks the connection type.
func (*Plugin) RegisterContract ¶
func (p *Plugin) RegisterContract( d *dispatcher.Dispatcher, reg contract.Registry, wreg contract.WardenRegistry, engine plugin.Engine, ) error
Source Files
Directories