0

I was involved in development of some service integration with magento. I provided this service callback URL. In controller/action I am creating a customer and making it logged in. But then I noticed an interesting thing:

On customer authorization magento does not correctly registering a visitor. Actually visitor exist, but it does not have customer_id (Looks like it's a guest).

Follow magento

admin area > customers > now online

I didn't saw that customer there.

This happened because of following code:

/**
 * Save visitor by request
 *
 * Used in event "controller_action_postdispatch"
 *
 * @param   \Magento\Framework\Event\Observer $observer
 * @return  \Magento\Customer\Model\Visitor
 */
public function saveByRequest($observer)
{
    // prevent saving Visitor for safe methods, e.g. GET request
    if ($this->skipRequestLogging || $this->requestSafety->isSafeMethod() || $this->isModuleIgnored($observer)) {
        return $this;
    }

Following code: $this->requestSafety->isSafeMethod() returns true. Because 3rd party service followed our callback url with GET request.

So what is the question:

Magento did that check to exclude all get requests while customer walking throw pages?

Is it for security reasons? For example magento is expecting that method $this->session->setCustomerDataAsLoggedIn($customer); should be called only from POST request?

If it's for security reasons, how somebody can exploit this?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.