Hi, we are getting numerous errors in prod that we are being blocked by what looks like Cloudfare, we are getting a page like this returned:

Why have I been blocked?</h2> <p data-translate="blocked_why_detail">This website is using a security service to protect itself from online attacks. The action you just performed triggered the security solution. There are several actions that could trigger this block including submitting a certain word or phrase, a SQL command or malformed data.</p>

I do see elevated blocks on your domain, what kind of request is it that you see this? Is this on legit traffic?

We believe they are all legit and its the whoami call that seems to be the problem.

according to cloudflare it is 97% SQL injection

Thanks

we also do see a sudden ~400% traffic increase on your domain, so I do suspect something weird going on

Yeah, we getting suspicous now as well. Will keep checking our side

Can you share the few lines of code where you do the

toSession

call so we can understand what headers, body, cookies, ... are send?

Thanks Patrik, looks like it was somewhat a false alarm. We had a Pentest that was supposed to run (but not on Prod!) and they started early and it looks like it was them. We’ll get that stopped. But for now, thanks for the help!

OK 👍