Troubleshooting
Filter-level symptoms for pow-proxy-wasm
| Symptom | Check |
|---|---|
| Filter never loads / Envoy logs config fail | secret missing or < 32 bytes |
| Always 403 challenge page | Cookies blocked; clock skew; IP context changed between issue and solve |
| Works then re-challenges after ~30 min | Clearance expired — expected |
| Works then re-challenges after ~60s without clearance | Clearance not set (response path); check logs for generate errors |
| Context mismatch in logs | Client IP changed (XFF vs direct); normalize hop trust |
| Too hard / too easy for users | Tune base_difficulty / min / max; watch dynamic tick logs |
When deployed by kubeWAF, also check:
status.challengeEnabled/status.challengeSecretNameon theWAF- Operator wasm serve:
challengeWasmFile/challengeWasmSourceURL - kubeWAF challenge guide
- kubeWAF troubleshooting