memory/patterns/finanzblick-sync-waf.md at 1d036dbcdc3958adf10a4c744b5d3402d21c8f0e

Files

T

Dominik Schön bbbe4f8985 feat: patterns/ directory + skill-impact tracker (WikiSkill-inspired)

- New patterns/ directory with 7 initial failure-mode patterns (PAT-001..007)
- skill-impact.md audit trail for skill modifications
- _template.md for future pattern creation
- index.md updated with Patterns section
- log.md entry for this change
- Inspired by arXiv:2608.27454 (WikiSkill)

2026-08-30 11:16:19 +00:00

1.8 KiB

Raw Blame History

pattern_id, title, category, severity, status, first_observed, last_updated, related_systems, related_solution_docs, related_skills

pattern_id

title

Symptom

Programmatic synchronization with Finanzblick (banking data aggregator) fails when calling the POST /sync API endpoint directly. The request is blocked by the WAF (Web Application Firewall), returning 403 or connection reset.

Historical fetches (without sync) work fine with the --no-sync flag, avoiding 2FA.

Root Cause

Finanzblick's WAF detects and blocks automated POST requests to the sync endpoint that don't originate from the legitimate browser session with proper CSRF tokens and session cookies.

Mitigation

Sync must be performed via the UI button + 2FA modal sequence:

Navigate to the Finanzblick web interface in a browser
Click the sync button (UI-triggered, not API)
Handle the 2FA modal sequence in order:
- PIN modal → click OK
- AUTH modal → click WEITER
- ERR modal → click OK
Wait for sync completion

For historical data fetches (no sync needed), use the --no-sync flag — this bypasses 2FA entirely.

Prevention

Never attempt direct POST /sync calls — always use the UI flow
The finanzblick-cashflow skill encodes this modal sequence
This skill is USER-OWNED and needs hermes curator adopt to manage

Evidence

Observed during Finanzblick cashflow analysis sessions (Jul 2026)
MEMORY.md entry: "FB sync=UI btn+2FA modals(PIN→OK,AUTH→WEITER,ERR→OK). POST /sync=WAF-blocked. --no-sync flag for hist.fetches(no 2FA). fb-cashflow skill=USER-OWNED,needs hermes curator adopt."

1.8 KiB Raw Blame History

Finanzblick sync requires modal sequence — POST /sync is WAF-blocked