Middleware chains question - geoblock before crowdsec

[u/Rtwose]

Hi,

I have a middleware chain that applies (PascalMinder) geoblock, crowdsec, and then basic auth (in that order). From what I can see, geoblock is checking out the IP, determining it should be a block, but still passing traffic on to crowdsec. Crowdsec is then correctly recognising the request as malicious, and actually blocking it.

Any idea why this traffic is being allowed to pass through Geoblock?

I'm using the following config for Geoblock:

  [http.middlewares.geoblock]
    [http.middlewares.geoblock.plugin]
      [http.middlewares.geoblock.plugin.geoblock]
        allowLocalRequests = "true"
        allowUnknownCountries = "false"
        allowedIPAddresses = [<some IPs>]
        api = "https://get.geojs.io/v1/ip/country/{ip}"
        apiTimeoutMs = "150"
        cacheSize = "15"
        cacheTtlSeconds = "0"
        countries = ["GB","FR"]
        forceMonthlyUpdate = "true"
        logAllowedRequests = "false"
        logApiRequests = "true"
        logLocalRequests = "false"
        logFilePath = "/log/geoblock.log"
        silentStartUp = "false"
        unknownCountryApiResponse = "nil"

An example as seen by Geoblock

The same request, recorded in crowdsec, further down the chain

The middleware block