4 ms·
Why only POST? Query params can be "hidden" in a similar way too, is there a reason GET requests are not vulnerable? Url length limit maybe?
by trulyme 5y ago
Why only POST? Query params can be "hidden" in a similar way too, is there a reason GET requests are not vulnerable? Url length limit maybe?
- ypeter 5y agoI guess this limitation is on the size of the request body and including that doesn’t make sense for GET requests?
- beny23 5y agoTypically query string sizes are limited to 2K
- trulyme 5y agoThis limit is often on client side though, so it pays to chech how this particular API does it.
- JoBrad 5y agoGET doesn’t typically have a body, and many services ignore it even if you include one. An API I once worked on simply truncated the body of all GET requests at the front door, because we knew we’d never use it. Less to worry about.
- trulyme 5y agoSorry if I wasn't clear enough, I was talking about query params in the URL, not request body.
- parts 5y agoHi, article author here. Cloud Armor will drop requests without regard to the size of the request body for HTTP PUT or PATCH request (i.e., the payload won't have to padded with 8192 bytes, like in the case of POST requests.) Of course, for an attacker to successfully exploit this, the underlying application would have to be configured to accept and process PUT/PATCH requests. As for query parameters in GET requests, I'm not entirely sure about Cloud Armor's limits there. I'll check and get back to you.