Actions
Improvements #14459
open
MV
MV
Do not allow non-sessioned signal GET requests
Improvements #14459:
Do not allow non-sessioned signal GET requests
Start date:
04/07/2026
Due date:
% Done:
0%
Estimated time:
Description
Previously, we have made two optimizations:
- #13878: where it was no longer allowed to get sessioned requests from bots (user agents marked as bots in the config).
- #13970: where a GET request with session information attached was suspected to come from a "malicious" agent.
From both of these we can take another optimization. In the case of an agent performing a GET request with ONLY a signal. This should also not be allowed.
In this case, they will receive the output of the application, and the session will be immediately terminated.
MV Updated by Matthias Van Ceulebroeck 5 months ago
- Status changed from InProgress to Review
- Assignee deleted (
Matthias Van Ceulebroeck)
RM Updated by Romain Mardulyn 5 months ago
- Assignee set to Romain Mardulyn
RM Updated by Romain Mardulyn 5 months ago
- Status changed from Review to Implemented @Emweb
- Assignee changed from Romain Mardulyn to Matthias Van Ceulebroeck
Actions