Reputation: 1294
In my web application i am using signalR. SignalR connection is using the longpolling transport, which is making the POST request to the server and passing parameters in the query string.
Now i scanned my application using the IBM app scan tool. The test manipulated /signalr/poll request's Method from POST to GET and executed the manipulated required on the server. Server responded same in case of both GET and POST verbs for same request. So tool reported this request vulnerable because responses are identical.
So how can i restrict on the signalR HUB server to accept this request only using POST method?
Below is the requets:
Upvotes: 3
Views: 710