agent: Enforce PUT for session destroy. Fixes #285.

hashicorp · Aug 19, 2014 · 96648dd · 96648dd
1 parent e2118d2
commit 96648dd
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/command/agent/session_endpoint.go b/command/agent/session_endpoint.go
@@ -103,6 +103,12 @@ func FixupLockDelay(raw interface{}) error {
 
 // SessionDestroy is used to destroy an existing session
 func (s *HTTPServer) SessionDestroy(resp http.ResponseWriter, req *http.Request) (interface{}, error) {
+	// Mandate a PUT request
+	if req.Method != "PUT" {
+		resp.WriteHeader(405)
+		return nil, nil
+	}
+
 	args := structs.SessionRequest{
 		Op: structs.SessionDestroy,
 	}