Skip to content

Reject unknown actions with 400 bad request - #1033

Merged
javuto merged 1 commit into
developfrom
unknown-action-default
Sep 6, 2026
Merged

Reject unknown actions with 400 bad request#1033
javuto merged 1 commit into
developfrom
unknown-action-default

Conversation

@javuto

@javuto javuto commented Sep 6, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • Reject unknown query actions with 400 Bad Request.
  • Reject unsupported MFA methods instead of treating them as TOTP.
  • Preserve MFA challenges after invalid method requests.
  • Add regression tests for query state, audit logging, and MFA validation.

Validation

  • go test ./...

@javuto javuto added osctrl-api osctrl-api related changes 🔐 security Security related issues labels Sep 6, 2026
@javuto
javuto merged commit ece759e into develop Sep 6, 2026
7 checks passed
@javuto
javuto deleted the unknown-action-default branch September 6, 2026 09:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

osctrl-api osctrl-api related changes 🔐 security Security related issues

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant