Ugh — looks like Vercel put a “System Mitigations” client-side security intercept/redirect check on the @eleventy Indieweb Avatar Image service, which caused images served by the service to break (since it is serving image content, not HTML). 😢
Also posted to Bluesky.
14 replies
vercel is trying to put javascript in my pngs
-
Coolify is a really awesome platform, been building up a system on a test server to learn it
yo dawg we heard you liked javascript
not the pings! leave my rasters alone
-
Are you referring to our Firewall challenges? Screenshot below for what it looks like.
It should only be automatically triggered when protecting your site from an attack, but it's possible something went wrong. Happy to take a look.
yeah — I had to disable the feature but why was it intercepting `image/` requests?
Oh, did you have attack challenge mode specifically turned on? It would make sense that it is in front of all incoming requests.
If you still want to challenge traffic *except* `image/`, you can create an exclusion with a custom WAF rule.
Naw, this was the stock setting. The project is exclusively image content so I guess I will just leave the feature off for now — what’s a normal traffic threshold for the Firewall to block requests?
javascript doesn’t belong in my pngs
@westbrook don’t threaten me with a good time
@zachleat can you uuencode the images then decode them in browser?
@adamarmfield I just disabled the feature in the Admin panel for now!