[GH-ISSUE #23] Handling registration requests with broken/incomplete JSON payload #5

New issue

Closed

opened 2026-03-13 15:19:35 +03:00 by kerem · 4 comments

kerem commented

2026-03-13 15:19:35 +03:00

Owner

Originally created by @joohoi on GitHub (Nov 15, 2017).
Original GitHub issue: https://github.com/acme-dns/acme-dns/issues/23

To continue from discussion started here:
https://github.com/joohoi/acme-dns/pull/20#discussion_r150984732

ping @koesie10

Which approach would be the intuitive and appropriate if broken or incomplete JSON object (or whatever payload) is sent to registration endpoint:

acme-dns should return error, like 400 Bad Request with descriptive error message.
Registration should complete with default values, and return these to the user.

Previously I felt that the second one would be the correct approach, but now I'm starting to lean towards the first one.

Originally created by @joohoi on GitHub (Nov 15, 2017). Original GitHub issue: https://github.com/acme-dns/acme-dns/issues/23 To continue from discussion started here: https://github.com/joohoi/acme-dns/pull/20#discussion_r150984732 ping @koesie10 Which approach would be the intuitive and appropriate if broken or incomplete JSON object (or whatever payload) is sent to registration endpoint: 1) acme-dns should return error, like `400 Bad Request` with descriptive error message. 2) Registration should complete with default values, and return these to the user. Previously I felt that the second one would be the correct approach, but now I'm starting to lean towards the first one.

kerem closed this issue

2026-03-13 15:19:40 +03:00

kerem commented

2026-03-13 15:19:46 +03:00

Author

Owner

@koesie10 commented on GitHub (Nov 15, 2017):

I would expect an error to be returned, as otherwise you would be opening yourself to security risks, such as allowing requests from all IPs. Of course, this is usually just an extra security measure, but in case your username and passwords are compromised, it is still an effective security measure that would be disabled without warning when you send an invalid JSON request.

@koesie10 commented on GitHub (Nov 15, 2017): I would expect an error to be returned, as otherwise you would be opening yourself to security risks, such as allowing requests from all IPs. Of course, this is usually just an extra security measure, but in case your username and passwords are compromised, it is still an effective security measure that would be disabled without warning when you send an invalid JSON request.

kerem commented

2026-03-13 15:19:51 +03:00

Author

Owner

@joohoi commented on GitHub (Nov 15, 2017):

Yeah, that's the reasoning that makes me lean towards the second option too. I'll implement that.

@joohoi commented on GitHub (Nov 15, 2017): Yeah, that's the reasoning that makes me lean towards the second option too. I'll implement that.

kerem commented

2026-03-13 15:19:56 +03:00

Author

Owner

@koesie10 commented on GitHub (Nov 15, 2017):

Great, thanks for the project! I'm using it in combination with my own Certbot hook to automate issuing and renewing domains without having to change anything on the server, like is required for the http-01 and tls-sni-01.

@koesie10 commented on GitHub (Nov 15, 2017): Great, thanks for the project! I'm using it in combination with [my own Certbot hook](https://github.com/koesie10/acme-dns-certbot-hook) to automate issuing and renewing domains without having to change anything on the server, like is required for the http-01 and tls-sni-01.

kerem commented

2026-03-13 15:20:01 +03:00

Author

Owner

@joohoi commented on GitHub (Nov 15, 2017):

Nice to hear that it's useful for you! I'm actually also an active Certbot developer, so if there's anything I can do to improve either project, please let me know! If it's Certbot related, using issues on Certbot repo, obiviously though :)

@joohoi commented on GitHub (Nov 15, 2017): Nice to hear that it's useful for you! I'm actually also an active Certbot developer, so if there's anything I can do to improve either project, please let me know! If it's Certbot related, using issues on Certbot repo, obiviously though :)

kerem referenced this issue

2026-03-13 16:12:46 +03:00

[PR #5] [MERGED] Comma tuning and added ipv6 example to JSON structure. #233