csrf protection in job_agent #47710
Open
csrf protection in job_agent #47710
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
richo-anyscale
force-pushed
the
richo/csrf-protection
branch
from
a74a272
to
783e182
Compare
alanwguo
reviewed
Sep 24, 2024
Comment on lines
271
to
274
| return Response( | ||
| text="Method not allowed", | ||
| status=aiohttp.web.HTTPNotAllowed.status_code, | ||
| ) |
There was a problem hiding this comment.
Should we tell people that browser requests are not supported? Or do we purposely not expose this detail?
There was a problem hiding this comment.
I don't think there's meaningful value to hiding it although you are so far from a supported path if you wind up there. I can adjust the message.
richo-anyscale
force-pushed
the
richo/csrf-protection
branch
from
72f620b
to
862526c
Compare
thomasdesr
force-pushed
the
richo/csrf-protection
branch
from
862526c
to
13a8b6a
Compare
richo-anyscale
force-pushed
the
richo/csrf-protection
branch
6 times, most recently
from
9372710
to
0c77509
Compare
richo-anyscale
force-pushed
the
richo/csrf-protection
branch
from
7f18443
to
7bff12f
Compare
Signed-off-by: Richo Healey <[email protected]>
Signed-off-by: Richo Healey <[email protected]>
Signed-off-by: Richo Healey <[email protected]>
Signed-off-by: Richo Healey <[email protected]>
Signed-off-by: Richo Healey <[email protected]>
Signed-off-by: Richo Healey <[email protected]>
Signed-off-by: Richo Healey <[email protected]>
Signed-off-by: Richo Healey <[email protected]>
Signed-off-by: Richo Healey <[email protected]>
Signed-off-by: [email protected] <[email protected]>
Signed-off-by: Richo Healey <[email protected]>
richo-anyscale
force-pushed
the
richo/csrf-protection
branch
from
eb8275a
to
b82d2f9
Compare
Signed-off-by: [email protected] <[email protected]>
Signed-off-by: [email protected] <[email protected]>
richo-anyscale
force-pushed
the
richo/csrf-protection
branch
from
bc83761
to
0366be8
Compare
…o/csrf-protection
…o/csrf-protection
Signed-off-by: Richo Healey <[email protected]>
Signed-off-by: Richo Healey <[email protected]>
|
@alanwguo could you have another look? The implementation wound up changing quite a bit. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
r? @alanwguo
Why are these changes needed?
Prevent confused deputy attacks on the job_agent
Checks
git commit -s) in this PR.scripts/format.shto lint the changes in this PR.method in Tune, I've added it in
doc/source/tune/api/under thecorresponding
.rstfile.(Working on the checks!)