From d01b6089c419de01d07ad9b0b98c27e95d82e4f5 Mon Sep 17 00:00:00 2001 From: Viktor Liu Date: Wed, 23 Sep 2026 13:19:36 +0200 Subject: [PATCH] Document that credentials are accepted only in a URL-encoded body --- proxy/internal/auth/README.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/proxy/internal/auth/README.md b/proxy/internal/auth/README.md index 5ebf75cee..c99ddc660 100644 --- a/proxy/internal/auth/README.md +++ b/proxy/internal/auth/README.md @@ -1,7 +1,10 @@ # PIN and password authentication limits -PIN and password credentials are accepted only in a POST form body. Query-string -credentials and credentials on other HTTP methods are ignored. +PIN and password credentials are accepted only in a URL-encoded +(`application/x-www-form-urlencoded`) POST body. Query-string credentials, +multipart and other body encodings, and credentials on other HTTP methods are +ignored. The encoding is restricted because it is the one AppSec inspection can +redact before mirroring a request to the engine. The proxy permits a burst of five credential checks per account and service, then replenishes one check every six seconds (ten per minute). PIN and password