Return bad request if can't construct
If given a bad URI, e.g. "https://$bmc/?a=id;" return http bad request
(400) like we do other places, e.g. a few lines below.
Certain scanners expect to see bad request when crawling and probing for
vulnerabilities and using not valid URIs. Just dropping the connection
causes errors with these scanners. They think connection problem or
worse the server was taken down.
Tested: Tested downstream https://$bmc/?a=id; returns bad request.
Change-Id: I99a52d4c5e7f366046c5de1cf22c4db95ab39e13
Signed-off-by: Gunnar Mills <gmills@us.ibm.com>
diff --git a/http/http_connection.hpp b/http/http_connection.hpp
index 187a8a4..115b7ff 100644
--- a/http/http_connection.hpp
+++ b/http/http_connection.hpp
@@ -323,6 +323,8 @@
if (reqEc)
{
BMCWEB_LOG_DEBUG << "Request failed to construct" << reqEc;
+ res.result(boost::beast::http::status::bad_request);
+ completeRequest(res);
return;
}
thisReq.session = userSession;