Skip to content

Reject non-POST requests on gRPC and gRPC-Web servers - #377

Merged
vietj merged 1 commit into
mainfrom
reject-non-post-request-for-application-grpc
Oct 6, 2026
Merged

vietj merged 1 commit into
mainfrom
reject-non-post-request-for-application-grpc

Conversation

@vietj

@vietj vietj commented Oct 6, 2026

Copy link
Copy Markdown
Member

Motivation:

The gRPC protocol requires POST for all requests but the server
accepted any HTTP method.

Changes:

  • Return 405 with Allow: POST header for non-POST gRPC/gRPC-Web requests
  • Add HttpMethodValidationTest

Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com

@vietj vietj added this to the 5.3.0 milestone Oct 6, 2026
@vietj vietj added the bug Something isn't working label Oct 6, 2026
Motivation:

The gRPC protocol requires POST for all requests but the server
accepted any HTTP method.

Changes:

- Return 405 with Allow: POST header for non-POST gRPC/gRPC-Web requests
- Add HttpMethodValidationTest

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@vietj
vietj force-pushed the reject-non-post-request-for-application-grpc branch from ecd931c to e670f1e Compare October 6, 2026 20:41
@vietj
vietj merged commit 130c9c4 into main Oct 6, 2026
3 of 6 checks passed
@vietj
vietj deleted the reject-non-post-request-for-application-grpc branch October 6, 2026 20:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant