Feature #90134

Send 400 - BAD REQUEST on invalid hmacs from extbase forms

Added by Christian Eßl about 1 month ago. Updated about 8 hours ago.

Status:
Under Review
Priority:
Should have
Assignee:
-
Category:
Extbase
Target version:
-
Start date:
2020-01-16
Due date:
% Done:

0%

PHP Version:
Tags:
Complexity:
Sprint Focus:

Description

See issue #87917.
If a bot submits a faulty extbase form (like with a manipulated __trustedProperties field), usually the following uncaught exception will be thrown:

The given string was not appended with a valid HMAC

The server will then - as with any other exception - send a status 500 back, that makes it look as if an a server error occured. This also means the error will then be automatically logged with any logging tool you are using and you would have to either manually:
- block the bots that are using the form wrong
- create a rule in your logging tool to prevent those messages from flooding your logs.

I think it would be better to just send a status code "400 - BAD REQUEST" in this case. As this actually comes from a bad client request the server can't compute.


Related issues

Related to TYPO3 Core - Bug #87917: Bot manipulated form fields lead to exception Rejected 2019-03-14

History

#1 Updated by Christian Eßl about 1 month ago

  • Related to Bug #87917: Bot manipulated form fields lead to exception added

#2 Updated by Christian Eßl about 1 month ago

  • Description updated (diff)

#3 Updated by Christian Eßl 1 day ago

  • Subject changed from Send 404 - BAD REQUEST on invalid hmacs from extbase forms to Send 400 - BAD REQUEST on invalid hmacs from extbase forms

#4 Updated by Gerrit Code Review 1 day ago

  • Status changed from New to Under Review

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/63272

#5 Updated by Gerrit Code Review about 24 hours ago

Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/63272

#6 Updated by Gerrit Code Review about 8 hours ago

Patch set 3 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/63272

Also available in: Atom PDF