shekhar/windows-iso-downloader
1
0
Fork 0
Code Issues Pull requests Projects Releases 15 Packages Wiki Activity Actions

fix: evict session and serve stale on Sentinel WAF block

Browse source 
When Microsoft Sentinel rejects a request (HTTP 502 with 'Sentinel'
in body), the session was being reused on every retry — hammering the
same poisoned session and making the block worse.

Now: detect Sentinel response, evict the session from cache, and
return a rateLimitError so stale-on-failure kicks in and users get
the last cached link instead of an error.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Shekhar Vaidya 2026-06-21 19:46:16 +05:30
parent 1ca871a839
commit 2a41874ad4
1 changed files with 11 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
backend/main.go
View file

@ -855,7 +855,17 @@ func fetchDownloadLinksFromMS(productID, skuID string) ([]byte, error) {
bodyBytes, _ := io.ReadAll(resp.Body)
if resp.StatusCode != http.StatusOK {
return nil, fmt.Errorf("Microsoft API returned HTTP %d: %s", resp.StatusCode, string(bodyBytes))
bodyStr := string(bodyBytes)
// Sentinel WAF block — the session is tainted; evict it so the next request
// starts a clean session rather than hammering the same poisoned one.
if strings.Contains(bodyStr, "Sentinel") {
cacheMutex.Lock()
delete(sessionCache, productID)
cacheMutex.Unlock()
log.Printf("MS fetch /proxy: Sentinel block for product_id=%s — session evicted\n", productID)
return nil, &rateLimitError{"Sentinel marked this request as rejected."}
}
return nil, fmt.Errorf("Microsoft API returned HTTP %d: %s", resp.StatusCode, bodyStr)
}
if len(bodyBytes) > 0 && bodyBytes[0] == '"' {