Actions
Improvements #14459
openDo not allow non-sessioned signal GET requests
Start date:
04/07/2026
Due date:
% Done:
0%
Estimated time:
Description
Previously, we have made two optimizations:
- #13878: where it was no longer allowed to get sessioned requests from bots (user agents marked as bots in the config).
- #13970: where a GET request with session information attached was suspected to come from a "malicious" agent.
From both of these we can take another optimization. In the case of an agent performing a GET request with ONLY a signal. This should also not be allowed.
In this case, they will receive the output of the application, and the session will be immediately terminated.
Updated by Matthias Van Ceulebroeck 15 days ago
- Status changed from InProgress to Review
- Assignee deleted (
Matthias Van Ceulebroeck)
Updated by Romain Mardulyn 15 days ago
- Status changed from Review to Implemented @Emweb
- Assignee changed from Romain Mardulyn to Matthias Van Ceulebroeck
Actions