Dominik Schön
bbbe4f8985
- New patterns/ directory with 7 initial failure-mode patterns (PAT-001..007) - skill-impact.md audit trail for skill modifications - _template.md for future pattern creation - index.md updated with Patterns section - log.md entry for this change - Inspired by arXiv:2608.27454 (WikiSkill)
54 lines
1.8 KiB
Markdown
54 lines
1.8 KiB
Markdown
---
|
|
pattern_id: PAT-005
|
|
title: "Finanzblick sync requires modal sequence — POST /sync is WAF-blocked"
|
|
category: integration
|
|
severity: medium
|
|
status: active
|
|
first_observed: 2026-07
|
|
last_updated: 2026-08-30
|
|
related_systems: []
|
|
related_solution_docs: []
|
|
related_skills: [finanzblick-cashflow]
|
|
---
|
|
|
|
# Finanzblick sync requires modal sequence — POST /sync is WAF-blocked
|
|
|
|
## Symptom
|
|
|
|
Programmatic synchronization with Finanzblick (banking data aggregator) fails when
|
|
calling the `POST /sync` API endpoint directly. The request is blocked by the WAF
|
|
(Web Application Firewall), returning 403 or connection reset.
|
|
|
|
Historical fetches (without sync) work fine with the `--no-sync` flag, avoiding 2FA.
|
|
|
|
## Root Cause
|
|
|
|
Finanzblick's WAF detects and blocks automated POST requests to the sync endpoint
|
|
that don't originate from the legitimate browser session with proper CSRF tokens
|
|
and session cookies.
|
|
|
|
## Mitigation
|
|
|
|
Sync must be performed via the **UI button + 2FA modal sequence**:
|
|
1. Navigate to the Finanzblick web interface in a browser
|
|
2. Click the sync button (UI-triggered, not API)
|
|
3. Handle the 2FA modal sequence in order:
|
|
- PIN modal → click OK
|
|
- AUTH modal → click WEITER
|
|
- ERR modal → click OK
|
|
4. Wait for sync completion
|
|
|
|
For historical data fetches (no sync needed), use the `--no-sync` flag — this
|
|
bypasses 2FA entirely.
|
|
|
|
## Prevention
|
|
|
|
- Never attempt direct `POST /sync` calls — always use the UI flow
|
|
- The `finanzblick-cashflow` skill encodes this modal sequence
|
|
- This skill is USER-OWNED and needs `hermes curator adopt` to manage
|
|
|
|
## Evidence
|
|
|
|
- Observed during Finanzblick cashflow analysis sessions (Jul 2026)
|
|
- MEMORY.md entry: "FB sync=UI btn+2FA modals(PIN→OK,AUTH→WEITER,ERR→OK). POST /sync=WAF-blocked. --no-sync flag for hist.fetches(no 2FA). fb-cashflow skill=USER-OWNED,needs `hermes curator adopt`."
|