I was involved in development of some service integration with magento. I provided this service callback URL. In controller/action I am creating a customer and making it logged in. But then I noticed an interesting thing:

On customer authorization magento does not correctly registering a visitor. Actually visitor exist, but it does not have customer_id (Looks like it's a guest).

Follow magento

admin area > customers > now online

I didn't saw that customer there.

This happened because of following code:

 * Save visitor by request
 * Used in event "controller_action_postdispatch"
 * @param   \Magento\Framework\Event\Observer $observer
 * @return  \Magento\Customer\Model\Visitor
public function saveByRequest($observer)
    // prevent saving Visitor for safe methods, e.g. GET request
    if ($this->skipRequestLogging || $this->requestSafety->isSafeMethod() || $this->isModuleIgnored($observer)) {
        return $this;

Following code: $this->requestSafety->isSafeMethod() returns true. Because 3rd party service followed our callback url with GET request.

So what is the question:

Magento did that check to exclude all get requests while customer walking throw pages?

Is it for security reasons? For example magento is expecting that method $this->session->setCustomerDataAsLoggedIn($customer); should be called only from POST request?

If it's for security reasons, how somebody can exploit this?

1 Answer 1


I would like to know that too.

Modules using customer_visitor data and ajax webapi requests after magento upgrade now stopped to work. Shall we start using ajax POST requests to controllers back again? I don't get it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.