Ticket #1926 (new enhancement)

Opened 2 years ago

Last modified 15 months ago

GET requests on target URLs of POST forms should be refused

Reported by: pitrou Owned by:
Priority: minor Milestone: 0.9.0
Version: 0.8.3 Keywords: web
Cc:

Description

At python.org we started having log entries like the following: 

X.Y.Z.W - - [11/Apr/2011:11:44:10 +0200] "GET /dev/buildbot/all/builders/x86%20debian%20parallel%203.x/builds/1940/rebuild HTTP/1.1" 302 278 "http://www.python.org/dev/buildbot/all/builders/x86 debian parallel 3.x/builds/1940" "WebReaper [support@webreaper.net]"

This triggered lots of spurious rebuilds. Since the "rebuild" form normally uses the POST method, it means the above bot/crawler is ill-behaved. Refusing GET requests on the rebuild URL (and other ones) would easily defend against such crawlers, and prevent rebuilds from polluting the build history.

Change History

comment:1 Changed 2 years ago by dustin

  • Keywords web added
  • Type changed from undecided to enhancement
  • Milestone changed from undecided to 0.8.+

This is not a bad idea, but it's probably a better idea to password-protect such forms.

comment:2 Changed 15 months ago by dustin

  • Milestone changed from 0.8.+ to 0.9.0

This is quite a good idea, in fact. In general, we should be sure that URLs are careful about which verbs they respond to.

Note: See TracTickets for help on using tickets.