Skip to content

Invalid error status codes for method/path mismatch (always 403) #2065

New issue
New issue
Open
Open
Invalid error status codes for method/path mismatch (always 403)#2065
@nezort11

Description

@nezort11
nezort11
opened on Feb 20, 2025

Hi, I think is not good to always return 403 when the request method or path does not match the expected. Instead:

  • when method does not match return 405
  • when path does not match return 404
  • when secret does not match return 403

Always returning 403 confuses the client that there is something wrong with the credentials, auth or etc. When there is just an issue with method/path

telegraf/src/telegraf.ts

Lines 121 to 131 in 0638cf4

if (req.method === 'POST') {
if (safeCompare(this.path, req.url as string)) {
// no need to check if secret_token was not set
if (!this.secretToken) return true
else {
const token = req.headers[TOKEN_HEADER] as string
if (safeCompare(this.secretToken, token)) return true
else debug('Secret token does not match:', token, this.secretToken)
}
} else debug('Path does not match:', req.url, this.path)
} else debug('Unexpected request method, not POST. Received:', req.method)

telegraf/src/core/network/webhook.ts

Lines 21 to 24 in 0638cf4

if (!filter(req)) {
debug('Webhook filter failed', req.method, req.url)
return next()
}

telegraf/src/core/network/webhook.ts

Lines 13 to 17 in 0638cf4

next = (): void => {
res.statusCode = 403
debug('Replying with status code', res.statusCode)
res.end()
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions