I was involved in development of some service integration with magento. I provided this service callback URL. In controller/action I am creating a customer and making it logged in. But then I noticed an interesting thing:
On customer authorization magento does not correctly registering a visitor. Actually visitor exist, but it does not have customer_id (Looks like it's a guest).
Follow magento
admin area > customers > now online
I didn't saw that customer there.
This happened because of following code:
/**
* Save visitor by request
*
* Used in event "controller_action_postdispatch"
*
* @param \Magento\Framework\Event\Observer $observer
* @return \Magento\Customer\Model\Visitor
*/
public function saveByRequest($observer)
{
// prevent saving Visitor for safe methods, e.g. GET request
if ($this->skipRequestLogging || $this->requestSafety->isSafeMethod() || $this->isModuleIgnored($observer)) {
return $this;
}
Following code: $this->requestSafety->isSafeMethod() returns true. Because 3rd party service followed our callback url with GET request.
So what is the question:
Magento did that check to exclude all get requests while customer walking throw pages?
Is it for security reasons? For example magento is expecting that method $this->session->setCustomerDataAsLoggedIn($customer);
should be called only from POST request?
If it's for security reasons, how somebody can exploit this?
