![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
Opened 11 months ago
#63940 new defect (bug)
Prevent POST flood cache bypass attacks
| Reported by: | prestonwordsworth | Owned by: | |
|---|---|---|---|
| Priority: | normal | Milestone: | Awaiting Review |
| Component: | Security | Version: | 6.8.2 |
| Severity: | normal | Keywords: | |
| Cc: | Focuses: |
Description
When a POST request is sent to a regular page with no data/body, a 200 response containing the page content is returned just like with a GET request.
We have seen such requests being used to bypass our caching system.
Would it be possible for WP to return 405 when a page isn’t supposed to receive POST requests?
Note:
See TracTickets
for help on using tickets.
