Access Denied script errors [was: Intermittent Error 403]

[SherpDaWerp]

Apologies in advance (or in hindsight, for those of you who have already noticed).

We have noticed a fairly serious security hole in the website. We have no evidence that this security hole has ever been exploited, and it does not expose any user data in any event.

However, efforts to patch it may result in intermittent 403 errors until we figure out the best solution.

Thanks for your patience during this time.

[Beliras]

Thx for notifying me! You can just delete this comment and lock this thread if you don't want me to talk here, tho.

[Dimetrodon Empire]

Thank you for letting us know.

[Star Federation]

Apologies in advance (or in hindsight, for those of you who have already noticed).

We have noticed a fairly serious security hole in the website. We have no evidence that this security hole has ever been exploited, and it does not expose any user data in any event.

However, efforts to patch it may result in intermittent 403 errors until we figure out the best solution.

Thanks for your patience during this time.

Will these be serious or minor?

[Of The Revived Soviet Union]

Apologies in advance (or in hindsight, for those of you who have already noticed).

We have noticed a fairly serious security hole in the website. We have no evidence that this security hole has ever been exploited, and it does not expose any user data in any event.

However, efforts to patch it may result in intermittent 403 errors until we figure out the best solution.

Thanks for your patience during this time.

Will these be serious or minor?

Another issue - This is not limited to Error 403. Tons of leaderboard nations lead to a Page Not Found, the forum half the time will end up saying the board has no forums - I believe someone is trying to abuse it.

[Rylland]

Thank you Sherp, i almost panic when the server hamster rebelled again.

[United Calanworie]

Will these be serious or minor?

Another issue - This is not limited to Error 403. Tons of leaderboard nations lead to a Page Not Found, the forum half the time will end up saying the board has no forums - I believe someone is trying to abuse it.

We have seen no indications that somebody is trying to abuse it. We're just (painfully) trying to fix the bug.

[Of The Revived Soviet Union]

Another issue - This is not limited to Error 403. Tons of leaderboard nations lead to a Page Not Found, the forum half the time will end up saying the board has no forums - I believe someone is trying to abuse it.

We have seen no indications that somebody is trying to abuse it. We're just (painfully) trying to fix the bug.

Is there any way I can send over screenshots? I have quite a few screenshots of the forums breaking fully, random nations/regions not loading, etc.

[United Calanworie]

I promise you that we do not need your screenshots.

[Shazbotdom]

Gratzi for the heads-up.

[Republic of Libriano]

Thank you for the information. I hope you will be able to fix the bug soon.

[Skorpiie]

Thanks a lot! Lets hope it’s not gonna turn into something serious

[Quebec and Shingoryeo]

Thank you for letting us know!

[Panay Islands and Guimaras]

Thanks, I hope nothing serious about that

[SherpDaWerp]

The issue has been fixed, so we are no longer fiddling. Please return to business as usual, and thanks again for bearing with us.

This thread has been locked, and will be unstickied in about an hour - if I remember.

[Iznjiha]

The issue has been fixed, so we are no longer fiddling. Please return to business as usual, and thanks again for bearing with us.

This thread has been locked, and will be unstickied in about an hour - if I remember.

You haven't locked it Sherp.

[SherpDaWerp]

Well I had, but I unlocked it shortly after unstickying, as I've heard reports that this fix may still be impacting some parts of the site, and wanted to make sure there was somewhere on-site to report it.

At this point, it looks like the fix is unintentionally enforcing that people make well-formed GET requests to our cgi endpoints (api.cgi, join_un.cgi, etc). Requests that split their parameters using / instead of ? and & are getting blocked. We are still debating whether this is worth fixing, or whether we will end up leaving it and requiring script developers to follow the web spec. The only promise we are making right now is that correctly-formatted GET requests (i.e. using ? and &) will always be supported, so if you want your script to work immediately and keep working into the future, make sure you're doing that.

If you don't know what that means, it doesn't affect you.

[Trotterdam]

Huh. I know that the main site treats / similarly to ? and &, but it hadn't occurred to me that anyone might try doing the same thing on the API.

The API does allow the use of ; instead of &, which appears even in example queries on the documentation page. This appears to still work. (I've always wondered what the point of that is...)

[Areutia]

Ive noticed on more than one site that 403 errors can be resolved with continuous page refreshing, in most cases.