#firewall

system Thank you for bringing this to our attention. To ensure this is investigated with the necessary priority and privacy, please report all security-related concerns, potential exploits, or abuse directly to the Vercel Security Team. Please submit your report here: vercel.com/abuse Reporting via this official channel is the fastest way to reach our security engineers and ensures that sensitive information is handled in a secure environment rather than a public forum.

Pauline P. Narvas Hey, @ninjeneer! Welcome Have you exceeded the number of IPs allowed in a single condition? I believe it allows 75 ips to be added.

Ninjeneer Hey, I wiped the rule since, but from what I remember yeah we were close to this number! I didn't know there was such limit, thanks for the insights

Anshuman Bhardwaj Hi @bob-1011, welcome to the Vercel Community! I recommend checking the **Firewall** section in your Vercel dashboard and then setting a rule for the Facebook crawler to bypass the Firewall. Please note, this may lead to more than usual traffic and I only recommend doing this if you are able to identify the exact user-agent and bot in the Firewall dashboard that you want to allow.

system Thank you for bringing this to our attention. To ensure this is investigated with the necessary priority and privacy, please report all security-related concerns, potential exploits, or abuse directly to the Vercel Security Team. Please submit your report here: vercel.com/abuse Reporting via this official channel is the fastest way to reach our security engineers and ensures that sensitive information is handled in a secure environment rather than a public forum.

Hali New DDOS request has been sended. 1m requests sent successfully with no deny and my project get pause

Amy Egan Were the visits from verified bots? Can we see the graph?

Ryu Hi Kemal, I’d be careful about concluding this is definitely Vercel blocking `dataaccessd` just from the app logs. If the request fails at TLS, redirect validation, HEAD handling, or a firewall layer before the function runs, you may also see no application log entry. For iOS Calendar, I’d test the feed like an automated calendar client instead of only from a browser: ``` URL="https://www.gocutit.com/api/sync/calendar/example.ics" curl -i -L "$URL" curl -I -L "$URL" curl -i -L \ -A "dataaccessd/1.0" \ -H "Accept: text/calendar,*/*" \ "$URL" ``` I’d want all of those to return a plain `200`, not a challenge page, login page, HTML page, or redirect loop. The response should look roughly like: ``` HTTP 200 Content-Type: text/calendar; charset=utf-8 BEGIN:VCALENDAR VERSION:2.0 ... END:VCALENDAR ``` A couple of iOS-specific things I’d check: ``` - HEAD requests return 200, not 405/404 - the final URL after redirects is still HTTPS - there is no auth cookie/session requirement - no HTML is returned for unknown/expired calendar tokens - the feed works from the apex/www version you actually paste into iOS - the URL contains no unescaped spaces, brackets, or copied punctuation ``` If the `dataaccessd` curl test works but the phone still fails, I’d check Vercel Firewall events for the exact timestamp. A normal custom bypass rule only helps if a custom/managed rule is the thing blocking the request; if it is a TLS/DNS/validation issue, the bypass rule will not change anything. As a stronger isolation test, I’d deploy the same static `.ics` file on a completely plain path like: ``` /calendar-test.ics ``` with no API route, no rewrite, no middleware, no auth, and no custom firewall rule. If iOS still fails on that plain static file while Google/Outlook work, then the next useful evidence is the exact URL form pasted into iOS, the `curl -I -L` output, and whether the failure happens on both Wi-Fi and mobile data.

Flamingooreo I have the exact same issue. Getting 403 on all my subdomains ID: `kix1::9t22w-1778462415363-6059aa76bf8f`

Anshuman Bhardwaj Hi there, I see that there's an ongoing support thread about this and our Support team experts are sharing solutions there. To avoid miscommunication or duplicates I'll defer to them.

Mikelabs They closed my ticket and did not resolve the issue, then issued me a refund. It would be nice if someone from the Vercel team could actually address this.

Mikelabs This is still totally unresolved

Pauline P. Narvas Thank you for the detail. We've shared with our engineering team and will loop back!

Pauline P. Narvas Hi, Ahmed! Thanks for your patience. I came across your post again as I'd been reaching out to community members about our upcoming Vercel Community session. It might be relevant to you given your original post https://community.vercel.com/t/how-to-protect-your-vercel-site-from-common-attacks/4652

system Hey @ahmedsaed! 👋 Just checking in on this thread. If you're still experiencing issues or have additional details to share, please let us know! We're here to help.

Message Agency I'm also curious about how to handle this. Another thread that turned up was closed without an answer https://community.vercel.com/t/firewall-api-on-ip-blocking-rules-changes-open-graph/1538

mcrisostomo Having the same issue and trying to find out best practice to configure this.

mcrisostomo Actually I just figured this out. We need to also pass the `x-vercel-set-bypass-cookie=true` query param @arpanpatel-6037

Pauline P. Narvas Thank you for the feedback, Sebastian! We're currently reworking the templates. We'll loop back here with updates!

Amy Egan 1. Blocked IP ranges and usage When you create a WAF rule that blocks an IP range, those blocked requests do not contribute to your Edge Request or Fast Data Transfer usage. The blocking happens before the request is processed as an edge request. 2. Persistent actions for Hobby users Persistent actions are currently only available on Pro and Enterprise plans. Attack Challenge Mode adds an extra layer of protection when you think your site is under attack. Keep in mind that Hobby accounts aren't charged for extra usage beyond the included limits. 3. Rate limiting Rate limiting is charged per million allowed requests, not blocked ones. So a misconfigured rule that logs but doesn’t block would still count toward your usage since those requests are being “allowed” through the rate limiter. 4. Vercel Firewall The firewall is the first checkpoint, not a separate double-check system. Requests are filtered immediately, and only clean traffic proceeds.

Chandrapal Badshah Thanks for your response. For answer to question 1, there’s contradicting documentation. Project Level IP blocking says “Requests will not contribute to your bill” However, looking at WAF pricing it says the blocked requests for Project level IP blocking will contribute to usage. I have manually tested this and found having a project level IP blocking doesn’t add to ER or FDT usage.

Amy Egan Firewall mitigated traffic is now free on Vercel https://vercel.com/changelog/web-application-firewall-mitigated-traffic-is-free-on-vercel

system Hi there, sorry that you are facing this issue. You can open a **Billing** support case from https://vercel.com/help to get your refund. If you've already opened a case, rest assured our support team will help you as soon as they get to the ticket. > Customers on all plan types are welcome to open a new case for any billing issue. Just describe the problem to the AI chat bot and click the “Create Case” button that appears at the bottom of the chat window. The AI will autofill the form based on the info provided. Then, you can review and adjust any info in the form before submitting it to reach our billing experts.

Pauline P. Narvas Thank you so much for sharing this and helping the rest of the community

Anshuman Bhardwaj Hi @ghoshan-ai, thanks for highlighting this feedback. I've reached out to the team and they'll take a look and reply here.

Anshuman Bhardwaj Hi @ghoshan-ai, this is what our team suggested: > The traffic inbound from those corporate networks looks bot-like because firewalls on these networks are likely acting as forward proxies that are intercepting, analyzing, and forwarding that traffic. In scenarios like this we see abusive scraper traffic intermingled with authentic customers but the presence of the firewall makes distinguishing between the two unreliable. Regarding your indication of firefox users, it looks like you had two checks from firefox that failed Bot ID and both were behind the aforementioned forward proxy. If you have a very high confidence that the botID detections are false positives then you can add WAF bypasses for the JA4 signatures of the challenged traffic. At present this kind of decision is best implemented in your WAF rather than as a global configuration within Bot ID or Bot Protection.

Ghoshan Ai Hello @anshumanb Thanks for the analysis. However, I cannot add the JA4 signatures of all our end users. For now i will rely on pure rate-limiting as a mitigation for bot abuse on the platform.