Repository navigation
Fix 500 on tokenless POST to unknown paths; ignore 4xx in EB health - #455
Merged
Merged
Conversation
…404, not 500 The catch-all route sends any verb to StaticController#not_found, which inherited ApplicationController's :null_session CSRF handler. That handler calls request.flash = nil, which this api_only app does not define in production (no Flash middleware), so bot probes like POST /login raised NoMethodError and returned 500 (about 1,400 of them on 2026-10-17). Skip forgery protection on this page-only controller.
Internet scanners probing /.env, /wp-login.php etc. produce short 4xx bursts that flip Thinly-env Ok -> Degraded/Severe -> Ok. Disable the ApplicationRequests4xx and ELBRequests4xx health rules; 5xx, latency and instance checks stay on.
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The health configuration needs corrected JSON serialization and rule structure before deployment.
1 open issue
What changed in this PR
Fixes tokenless requests to unknown paths and reduces scanner-driven Elastic Beanstalk health alerts.
Changes:
- Skips CSRF protection in the static-page and catch-all controller.
- Adds regression coverage for tokenless POST, PUT, PATCH, and DELETE requests.
- Configures enhanced health to ignore 4xx responses.
| File | Description |
|---|---|
spec/requests/static_spec.rb |
Tests that tokenless requests return 404. |
app/controllers/static_controller.rb |
Bypasses the failing CSRF handler. |
.ebextensions/06_health_rules.config |
Adds 4xx health-rule overrides. |
Review effort: Balanced
….Instance EB rejects a nested YAML mapping and the Rules.Instance scope. Verified with aws elasticbeanstalk validate-configuration-settings against Thinly-env.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Elastic Beanstalk emailed Thinly-env health flips (Ok -> Severe 89% 4xx at 12:01 UTC, Ok -> Degraded 63% 4xx at 18:27 UTC on 2026-10-18). The instance was healthy both times. The EB log bundle shows scanner bursts (about 320 requests in 3 min of /wp-login.php, /.env, /.git/config, /actuator/health) answered 404/403 by design, which EB counts against health.
The logs also showed a real bug: about 1,400
POST /loginrequests on 2026-10-17 returned 500 (NoMethodError: undefined method 'flash='from ApplicationController's:null_sessionCSRF handler; the api_only app has no Flash middleware in production).Changes
StaticController:skip_forgery_protection, so tokenless non-GET requests hitting the catch-all route return 404 instead of 500. The spec fails without the fix (4 failures) and passes with it..ebextensions/06_health_rules.config: disable theApplicationRequests4xxandELBRequests4xxenhanced-health rules. 5xx, latency and instance checks stay on.Test plan
bundle exec rspec spec/requests/static_spec.rb(17 examples, 0 failures); rubocop cleanaws elasticbeanstalk describe-configuration-settingsshows the ConfigDocument, andcurl -X POST https://thin.ly/loginreturns 404Not validated: the
.ebextensionsfile has not been applied to the live environment.