Project

General

Profile

Actions

Feature #90134

closed

Send 400 - BAD REQUEST on invalid hmacs from extbase forms

Added by Christian Eßl about 4 years ago. Updated over 1 year ago.

Status:
Closed
Priority:
Should have
Assignee:
-
Category:
Extbase
Target version:
-
Start date:
2020-01-16
Due date:
% Done:

100%

Estimated time:
PHP Version:
Tags:
Complexity:
Sprint Focus:

Description

See issue #87917.
If a bot submits a faulty extbase form (like with a manipulated __trustedProperties field), usually the following uncaught exception will be thrown:

The given string was not appended with a valid HMAC

The server will then - as with any other exception - send a status 500 back, that makes it look as if an a server error occured. This also means the error will then be automatically logged with any logging tool you are using and you would have to either manually:
- block the bots that are using the form wrong
- create a rule in your logging tool to prevent those messages from flooding your logs.

I think it would be better to just send a status code "400 - BAD REQUEST" in this case. As this actually comes from a bad client request the server can't compute.


Related issues 3 (0 open3 closed)

Related to TYPO3 Core - Bug #87917: Bot manipulated form fields lead to exceptionRejected2019-03-14

Actions
Related to TYPO3 Core - Bug #93667: Disable logging of invalid requests due to manipulated form submissionsClosed2021-03-06

Actions
Related to TYPO3 Core - Task #97830: Do not log HMAC validation errors in contentObject exception handlerClosedTorben Hansen2022-06-29

Actions
Actions

Also available in: Atom PDF