Geographic Access Control & Abuse Defense Architecture
Open-source, client-side web tools can become targets for automated abuse, proxy-routed scraping, or weaponized propaganda batch processing. Version 5.1.13 introduced a comprehensive, multi-tiered geographic access control and defense engine designed to restrict connections originating from the Russian Federation following sustained service misuse. By pairing edge CDN trace verification with client-side timezone heuristics and early session caching, Open Publisher neutralizes bad-faith traffic before the workspace initializes.
🛡️Multi-Layered Edge CDN & Heuristic Access Defense
Traffic originating from restricted regions is intercepted at initialization, halting application execution prior to canvas loading.
Edge CDN Trace Interception
The primary detection vector queries the edge reverse proxy during early application startup:
-
Authoritative Trace Query: Open Publisher fetches the edge trace endpoint (/cdn-cgi/trace). This payload returns authoritative Cloudflare edge metadata, including the client's ISO 3166-1 alpha-2 country code (loc=RU).
-
Immediate Execution Halt: If the client country matches restricted territories, the initialization loop breaks immediately, preventing document loading and API interaction.
-
Redundant Geo-IP Fallback: If the edge trace endpoint is unavailable or obscured, the defense engine invokes secondary low-latency geolocation endpoints (https://api.country.is) to verify origin.
Timezone & Locale Heuristic Defense
To protect against residential proxy routing where an edge IP appears neutral but client environment variables leak the true host origin, the engine evaluates browser system telemetry:
-
Russian Timezone Verification: The client timezone string is audited against 26 Russian timezones (including Europe/Moscow, Asia/Yekaterinburg, Asia/Novosibirsk, and Europe/Kaliningrad).
-
Language-Timezone Pairing: When a user's browser exhibits a Russian regional timezone paired with Russian language preferences (ru, ru-RU), the defense system engages automatically.
Early DOM Interception & Session Flags
The defense module is positioned at the top of the HTML head (extensions/geo-defense.js), running before heavy UI assets, fonts, or templates are fetched. Once identified, flags are written to localStorage and sessionStorage (op_ru_blocked = '1'), ensuring subsequent page refreshes terminate instantly without repeated network lookups.
Note: Self-hosted and on-premise enterprise deployments of Open Publisher can customize regional firewall policies in the server configuration.