Right now, filtering of traffic at the edge follows two paths and two paths only:
- if the request is in our web of trust, we skip all filtering
- Otherwise, all filtering is applied
We want to move to a different model, where we have more classes of users, instead than just full trust / no trust:
- We have at least 3 classes of users: trust / known / no trust where known can have various forms:
- The request has a valid sesssion token (see WE 5.1.2)
- The request comes from an IP/UA combination we consider "trusted"
- The request includes other identification methods
So, we want to be able to apply requestctl rules in various points of the process, and to vary which rules we apply to what.
Moreover, we want to be able to detect if a request comes from something looking like a browser, and apply the stricter limits we declare in the Robot Policy for such requests.
In oder to do this we need to:
- Add the ability for requestctl rules to be selected via some additional tags, or maybe just use specific alternative tags to "cache-text/cache-upload"
- Change radically how we do filtering at the edge. An early design schematics of how it will look is something like:
