Install the Fastly VCL v12 Enforcer

If your organization uses Fastly, you can use HUMAN’s Fastly VCL Enforcer to protect against malicious behavior. The Enforcer is deployed to your content delivery network (CDN) and dictates how traffic should be handled per your organization’s standards.

You can learn how to install the Fastly VCL Enforcer with this article.

Prerequisites

• Fastly account with engineer or higher permissions
• Depending on your preferred deployment method, the following tools:
  • Docker method:
    • Docker. See how to install Docker with their documentation.
  • Script method:
    • Node.js 18.x or later and npm 10.x or later. See how to install both with npm’s documentation.
    • Git CLI. You can download it directly from Git.
    • GNU Wget. See how to install with their documentation.
• Your unique HUMAN information:
  • Your Application ID. You can find this under Platform Settings > Applications > Overview in the HUMAN console. If you have multiple environments, you will also have multiple Application IDs, so be sure to choose the correct ID for the environment you want to install on.
  • Your Server Token. You can find this under Platform Settings > Applications, then selecting an application and navigating to Application settings > Server token.
  • Your Risk Cookie Key. You can find this under Bot Defender > Policies > Policy Settings > Policy Information.
• Other HUMAN information provided by your Solutions Engineer:
  • Your logger authentication token.
  • Your remote configuration authentication token.
  • Your remote configuration ID.
  • An Enforcer configuration file, enforcerConfig.json. Be sure to save it in a directory you’ll remember (like /deploy).

Contact Fastly

Fastly needs to activate certain functionality in your service so it works with the HUMAN Enforcer. Fastly is familiar with HUMAN and its Enforcer, so you can simply send them an email to enable it.

1. From the Fastly dashboard, select the service you want to add the Enforcer to.
2. Copy the service’s ID.
3. Email support@fastly.com with the following:

• Subject: Please enable HUMAN support for our Fastly service
• Body: Please enable HUMAN support for our service ID, <YOUR_ID_HERE>, and confirm when it is completed.

Fastly will add the following pragmas to your service:

• fix_unsent_body_drain: Used to resolve an issue with HTTP response bodies not being fully sent to the client.
• no_body_if_bereq_is_get_or_head: Used to prevent a response body from being sent to the client if the request method is GET or HEAD.

You can confirm that these pragmas were added by navigating to your service’s Service configuration > Show VCL.

Create a Fastly API token

1. Log in to your Fastly account.
2. Navigate to Account > API Tokens > Personal tokens.
3. Click Create token.
4. Enter a name for your token, then fill out the remaining fields according to the following:
5. Type: User token. Only available for Fastly Superusers. If you don’t see this field, you can skip this step.
6. Scope: Global API access (global) . Be sure to also deselect Read-only access (global:read), which is selected by default.
7. Access: All services or the specific services you want to deploy the Enforcer on
8. Click Create Token.
9. Copy and save the token in a secure location.

Update the configuration file

1. Update the Enforcer configuration file, enforcerConfig.json, with your unique HUMAN information if it hasn’t been already.

{
  "px_app_id": "`<APP_ID>`",
  "px_auth_token": "`<AUTH_TOKEN>`",
  "px_cookie_secret": "`<COOKIE_SECRET>`",
  "px_logger_auth_token": "`<LOGGER_AUTH_TOKEN>`",
  "px_remote_config_auth_token": "`<REMOTE_CONFIG_AUTH_TOKEN>`",
  "px_remote_config_id": "`<REMOTE_CONFIG_ID>`"
}

2. Save your file and continue with your preferred deployment method.
   3. Docker method 4. Script method

Run the Deploy Tool

Docker method

1. Pull the Docker Image by running:

$
docker pull us-docker.pkg.dev/hmn-registry/docker-public/cdn-enforcer-deploy-tool

2. Navigate to the directory where you created enforcerConfig.json. Based on our example from above, this would be the /deploy directory.
3. Run the deploy tool with the following:

$
docker run --rm -v $PWD:/app/local -it us-docker.pkg.dev/hmn-registry/docker-public/cdn-enforcer-deploy-tool

Script method

1. Navigate to the directory where you created enforcerConfig.json. Based on our example from above, this would be the /deploy directory.
2. Pull the HUMAN Deploy Tool zip from Google Artifact Registry using:

$
wget 'https://artifactregistry.googleapis.com/v1/projects/hmn-registry/locations/us/repositories/enforcers-public/files/cdn-enforcer-deploy-tool_win:1.7.0:cdn-enforcer-deploy-tool_win.zip:download?alt=media' -O cdn-enforcer-deploy-tool.zip

3. Unzip cdn-enforcer-deploy-tool.zip to the same directory you saved enforcerConfig.json in.
4. Run the tool by opening the appropriate script for your system:

• Windows: cdn-enforcer-deploy-tool.bat
• Mac or Linux: cdn-enforcer-deploy-tool.command

Deploy the Enforcer

1. When prompted, select Fastly VCL and hit Enter.

$
🚀 HUMAN CDN Enforcer Deploy Tool 🚀
$
? Which platform do you want to deploy to? (Use arrow keys)
$
❯ Fastly VCL
$
  Cloudflare Workers
$
  ...

2. Continue to follow the steps that appear to complete your deployment.
3. When you finish the setup, confirm that the displayed details are correct, then enter y to deploy the Enforcer.