Reduce log level of 501 Not Implemented responses #321
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
For public facing websites it's not uncommon to have exploitation suites run random strings as methods in small batches of requests. This commit channels 501s away from errors logs into info logs as we may still want to know that unknown methods are being used, typically though it's a part of the normal course of operation and don't want it to fill logging with high priority messages and potentially fall through into alerting for some users.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
For public facing websites it's not uncommon to have exploitation suites run
random strings as methods in small batches of requests. This commit channels
501s away from errors logs into info logs as we may still want to know that
unknown methods are being used, typically though it's a part of the normal
course of operation and don't want it to fill logging with high priority
messages and potentially fall through into alerting for some users.
(There is a potential here for allowing users to implement their own :error-handler in the yada context, but I figure that might be best separated into another PR. Also, I apologise if it's preferred that an issue be created beforehand, I figure better to have the fix in hand ¯\_(ツ)_/¯).