authgear / authgear/authgear-server
Use a separate middleware for main server 404 route
Open
- Dominant language
- Go
- Stars
- 2k
- Forks
- 125
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 32
Description
The middleware chain in use is for valid web pages. But the 404 page should not require CSRF (It should only serve HEAD and GET requests).
Contributor guide
Research direction
Start by locating the main server's 404 route and the middleware chain currently used for valid web pages. Trace how CSRF and request methods are enforced, then verify that the 404 path uses separate middleware and serves only HEAD and GET requests without requiring CSRF.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- backend
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100