From e1da30257591cf7abd36584feba8272f0da46b5e Mon Sep 17 00:00:00 2001
From: White-Lotus <95460219+mangyan1@users.noreply.github.com>
Date: Thu, 17 Sep 2026 06:13:13 -0600
Subject: [PATCH] appsec: return 403, not 200, when the failure action is deny

---
 lib/crowdsec.lua | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/crowdsec.lua b/lib/crowdsec.lua
index 1c58eb0..691d2b4 100644
--- a/lib/crowdsec.lua
+++ b/lib/crowdsec.lua
@@ -670,6 +670,9 @@ function csmod.AppSecCheck(ip)
   if runtime.conf["APPSEC_FAILURE_ACTION"] == DENY then
     ok = false
     remediation = runtime.conf["FALLBACK_REMEDIATION"]
+    -- a failing AppSec call returns this initial status code, so a deny
+    -- failure action must carry the forbidden code, not the 200 placeholder
+    status_code = ngx.HTTP_FORBIDDEN
   end
 
   local method = "GET"