From 893d8c7da0ce03da4d8c79e3ab41b14c54a8013a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gr=C3=A9goire=20Paris?= Date: Thu, 30 Nov 2017 16:41:50 +0100 Subject: [PATCH] Forbid method switching This averts the following scenario: 1. Client POSTs 2. server does not support mod rewrite and 302 redirects to /index.php/theaction 3. client follows, but with a GET 4. 405 --- symfony/apache-pack/1.0/public/.htaccess | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/symfony/apache-pack/1.0/public/.htaccess b/symfony/apache-pack/1.0/public/.htaccess index 92498919..bcce7fcc 100644 --- a/symfony/apache-pack/1.0/public/.htaccess +++ b/symfony/apache-pack/1.0/public/.htaccess @@ -62,7 +62,7 @@ DirectoryIndex index.php # When mod_rewrite is not available, we instruct a temporary redirect of # the start page to the front controller explicitly so that the website # and the generated links can still be used. - RedirectMatch 302 ^/$ /index.php/ + RedirectMatch 307 ^/$ /index.php/ # RedirectTemp cannot be used instead