search

letsencrypt / boulder

An ACME-based certificate authority, written in Go.
Mozilla Public License 2.0
5.22k stars 607 forks source link

wfe: Handle empty JSON to /acme/acct like POST-as-GET #7844

Open jprenken opened 3 days ago

jprenken commented 3 days ago

ACME clients can make an empty request to /acme/acct for their reg object. wfe.Account handled a truly empty request correctly, but misrouted empty JSON objects to updateAccount. This only happened to work because UpdateRegistration takes an entire Registration and returns it even if unchanged.

This preserves ACMEv1 backwards compatibility when the updateAccount flow is simplified.