Actions
Improvements #14459
openDo not allow non-sessioned signal GET requests
Start date:
04/07/2026
Due date:
% Done:
0%
Estimated time:
Description
Previously, we have made two optimizations:
- #13878: where it was no longer allowed to get sessioned requests from bots (user agents marked as bots in the config).
- #13970: where a GET request with session information attached was suspected to come from a "malicious" agent.
From both of these we can take another optimization. In the case of an agent performing a GET request with ONLY a signal. This should also not be allowed.
In this case, they will receive the output of the application, and the session will be immediately terminated.
Updated by Matthias Van Ceulebroeck about 5 hours ago
- Status changed from InProgress to Review
- Assignee deleted (
Matthias Van Ceulebroeck)
Updated by Romain Mardulyn about 4 hours ago
- Status changed from Review to Implemented @Emweb
- Assignee changed from Romain Mardulyn to Matthias Van Ceulebroeck
Actions