/api/secrets/get-session-key without a trailing slash returns 405 Method Not Allowed #3519

New Issue

adam · 2025-12-29T18:29:37+01:00

adam commented

2025-12-29 18:29:37 +01:00

Originally created by @dmfigol on GitHub (Mar 29, 2020).

Environment

Python version: 3.7.6
NetBox version: 2.7.9

Steps to Reproduce

POST /api/secrets/get-session-key with payload {"private_key": "whatever"}

Expected Behavior

Expected to work it the same regardless if the trailing slash is there or not, like the rest of API endpoints

Observed Behavior

Response is 405 Method Not Allowed

Originally created by @dmfigol on GitHub (Mar 29, 2020). ### Environment * Python version: 3.7.6 * NetBox version: 2.7.9  ### Steps to Reproduce 1. POST `/api/secrets/get-session-key` with payload `{"private_key": "whatever"}`  ### Expected Behavior Expected to work it the same regardless if the trailing slash is there or not, like the rest of API endpoints  ### Observed Behavior Response is **405 Method Not Allowed**

adam closed this issue

2025-12-29 18:29:37 +01:00

adam commented

2025-12-29 18:29:37 +01:00

@jeremystretch commented on GitHub (Mar 30, 2020):

Expected to work it the same regardless if the trailing slash is there or not, like the rest of API endpoints

Just a note: the trailing slash is always needed. Without it, a 302 redirect is returned for the correct URL.

@jeremystretch commented on GitHub (Mar 30, 2020): > Expected to work it the same regardless if the trailing slash is there or not, like the rest of API endpoints Just a note: the trailing slash is always needed. Without it, a 302 redirect is returned for the correct URL.

adam commented

2025-12-29 18:29:37 +01:00

@jeremystretch commented on GitHub (Mar 30, 2020):

I'm going to close this as this is expected behavior. Per the RuntimeError exception (raised when DEBUG is true):

RuntimeError: You called this URL via POST, but the URL doesn't end in a slash and you have APPEND_SLASH set. Django can't redirect to the slash URL while maintaining POST data. Change your form to point to localhost:8000/api/secrets/get-session-key/ (note the trailing slash), or set APPEND_SLASH=False in your Django settings.

@jeremystretch commented on GitHub (Mar 30, 2020): I'm going to close this as this is expected behavior. Per the RuntimeError exception (raised when `DEBUG` is true): > RuntimeError: You called this URL via POST, but the URL doesn't end in a slash and you have APPEND_SLASH set. Django can't redirect to the slash URL while maintaining POST data. Change your form to point to localhost:8000/api/secrets/get-session-key/ (note the trailing slash), or set APPEND_SLASH=False in your Django settings.

adam referenced this issue

2025-12-29 22:22:23 +01:00

[PR #3537] [CLOSED] Fixes: #3519 - Disallow(API) connections to virtual & wireless interfaces #12571

Sign in to join this conversation.

Branches Tags

main

update-changelog-comments-docs

feature-removal-issue-type

20911-dropdown

20239-plugin-menu-classes-mutable-state

21097-graphql-id-lookups

feature

fix_module_substitution

20923-dcim-templates

20044-elevation-stuck-lightmode

feature-ip-prefix-link

v4.5-beta1-release

20068-import-moduletype-attrs

20766-fix-german-translation-code-literals

20378-del-script

7604-filter-modifiers-v3

circuit-swap

12318-case-insensitive-uniqueness

20637-improve-device-q-filter

20660-script-load

19724-graphql

20614-update-ruff

14884-script

02496-max-page

19720-macaddress-interface-generic-relation

19408-circuit-terminations-export-templates

20203-openapi-check

fix-19669-api-image-download

7604-filter-modifiers

19275-fixes-interface-bulk-edit

fix-17794-get_field_value_return_list

11507-show-aggregate-and-rir-on-api

9583-add_column_specific_search_field_to_tables

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/netbox#3519