Skip to content

Reject non-POST requests on gRPC and gRPC-Web servers - #378

Merged
vietj merged 1 commit into
5.2from
reject-non-post-request-for-application-grpc-5.2
Oct 6, 2026
Merged

vietj merged 1 commit into
5.2from
reject-non-post-request-for-application-grpc-5.2

Conversation

@vietj

@vietj vietj commented Oct 6, 2026

Copy link
Copy Markdown
Member

Motivation:

The gRPC protocol requires POST for all requests but the server
accepted any HTTP method.

Changes:

  • Return 405 with Allow: POST header for non-POST gRPC/gRPC-Web requests
  • Add HttpMethodValidationTest

Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com

@vietj vietj added this to the 5.2.1 milestone Oct 6, 2026
@vietj vietj self-assigned this Oct 6, 2026
@vietj vietj linked an issue Oct 6, 2026 that may be closed by this pull request
@vietj
vietj force-pushed the reject-non-post-request-for-application-grpc-5.2 branch from 7d24bb1 to 8c33340 Compare October 6, 2026 20:40
Motivation:

The gRPC protocol requires POST for all requests but the server
accepted any HTTP method.

Changes:

- Return 405 with Allow: POST header for non-POST gRPC/gRPC-Web requests
- Add HttpMethodValidationTest

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@vietj
vietj force-pushed the reject-non-post-request-for-application-grpc-5.2 branch from 8c33340 to 78356bd Compare October 6, 2026 20:41
@vietj
vietj merged commit 2b18bc4 into 5.2 Oct 6, 2026
6 checks passed
@vietj
vietj deleted the reject-non-post-request-for-application-grpc-5.2 branch October 6, 2026 20:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

gRPC and gRPC-Web servers accept non-POST requests

1 participant