search

marrow / web.security

Access control list (ACL) authorization, authentication, and cross-site request forgery (CSRF) protection for WebCore applications.
MIT License
4 stars 3 forks source link

Open proxy probe detection. #10

Open amcgregor opened 2 years ago

amcgregor commented 2 years ago

An incoming HEAD request whose entire path portion of the URI is itself the URI being requested is very likely a probe for an open proxy. This should warrant a WAF rejection.

HEAD /https://example.com