[bot-detection] drop the URI from the cookie

[buixor]

drop uri from the cookie : it can be big, user-controlled and waste cookie space. Keep it available in on_submit tho

[github-actions]

@buixor: There are no 'kind' label on this PR. You need a 'kind' label to generate the release automatically.

• /kind feature
• /kind enhancement
• /kind refactoring
• /kind fix
• /kind chore
• /kind dependencies

Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

[github-actions]

@buixor: There are no area labels on this PR. You can add as many areas as you see fit.

• /area agent
• /area local-api
• /area cscli
• /area appsec
• /area security
• /area configuration

Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

[Copilot]

🟡 Changes recommended

The rune-boundary test currently doesn’t actually exercise the UTF-8 truncation backoff logic, and the proto-bridge file header comment is now inaccurate.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR reduces challenge cookie size pressure by bounding the fingerprint url stored in the sealed cookie while preserving the full submitted URL at JSON decode time for on_challenge_submit rules.

Changes:

• Add MaxFingerprintURLLen and boundFingerprintURL() to strip query/fragment first and then byte-truncate safely (UTF-8 valid) when needed.
• Apply URL bounding only in FingerprintData.ToProto() so inbound decoded payloads still expose the full href.
• Add unit tests covering URL bounding behavior and a regression test ensuring oversized URLs no longer prevent cookie sealing/opening.

File summaries

File	Description
pkg/appsec/challenge/fingerprint_proto.go	Introduces URL bounding helper/constant and applies it when building the protobuf stored in the cookie.
pkg/appsec/challenge/fingerprint_url_test.go	Adds tests for URL bounding, UTF-8 safety, decode behavior, and cookie sealing regression.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 64.68%. Comparing base (909b515) to head (cf20a87).

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #4656      +/-   ##
==========================================
- Coverage   64.71%   64.68%   -0.03%     
==========================================
  Files         522      522              
  Lines       39862    39861       -1     
==========================================
- Hits        25798    25786      -12     
- Misses      11663    11671       +8     
- Partials     2401     2404       +3     

Flag	Coverage Δ
bats	41.09% <0.00%> (+<0.01%)	⬆️
unit-linux	41.93% <100.00%> (-0.04%)	⬇️
unit-windows	30.52% <100.00%> (+0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[buixor]

/area appsec
/kind enhancement

[buixor]

need to test how it behaves during upgrade : what happens to existing cookies that do have the URL inside them.