feat: keep socket.io long polling out of the audit log (#32425)

With websocket support turned off, the browser falls back to HTTP long polling and every poll was written to the audit log as its own entry, flooding it. The same traffic over a websocket was never audited, and AUDIT_EXCLUDED_PATHS only matches API routes, so there was no way to filter it out. Polling requests are now skipped as well, so the audit log looks the same whichever transport is in use.

Fixes #31871
This commit is contained in:
Classic298 2026-10-14 22:01:10 +02:00 • committed by GitHub
parent bae22752d3
commit 209b15b963
No known key found for this signature in database
GPG key ID: B5690EEEBB952194

View file

@ -255,6 +255,9 @@ class AuditLoggingMiddleware:
if request.method not in self.audited_methods:
return True
if request.url.path.startswith('/ws/socket.io'):
return True
path = request.url.path.lower()
for endpoint in self.ALWAYS_LOG_ENDPOINTS:
if path.startswith(endpoint):