Hi everyone,
I wanted to share a new Caddy HTTP handler module we just open-sourced: caddy-hansestack.
It’s designed to add robust credential stuffing protection (checking passwords against known data breaches) to any existing backend without modifying the backend code itself. It sits in front of your auth routes and performs a k-anonymity check.
Why we built it as a Caddy module:
We needed a way to protect legacy auth flows where altering the backend code was too risky or expensive. By moving this into Caddy, the backend remains oblivious, and we can enforce strict fail-open policies at the infrastructure edge.
Key Features:
- Zero-Latency Mode (
enrich_response): Caddy forwards the login request to the backend immediately while querying the leak-check API in parallel. The API result is then injected as a header (X-Hansestack-Leaked: true) into the outgoing HTTP response. - Fail-Open by Design: Built-in circuit breakers and strict timeouts ensure that if the external API rate-limits or times out, the request is instantly passed through. Legitimate users are never locked out due to security layer degradation.
- Privacy First: Only 5-character SHA-1 prefixes are ever transmitted (k-anonymity).
You can find the module and the documentation here:
https://github.com/hansestack/caddy-hansestack
We also built a sandbox repository (Caddy + dummy backend + Grafana/Prometheus) simulating a 40k-request stress test to demonstrate the circuit breaker taking over:
https://github.com/hansestack/leakcheck-caddy-demo
Feedback, especially regarding idiomatic Caddy module design, is highly appreciated!
P.S.: I tried to officially register the package via caddyserver.com/account so it shows up on the download page, but the social login/registration seems to be throwing an error right now. Is there a new way to get the caddy-module picked up by the registry, or could someone give the sync a manual nudge?