{"action":"opened","issue":{"url":"https://api.github.com/repos/fuel/core/issues/1836","labels_url":"https://api.github.com/repos/fuel/core/issues/1836/labels{/name}","comments_url":"https://api.github.com/repos/fuel/core/issues/1836/comments","events_url":"https://api.github.com/repos/fuel/core/issues/1836/events","html_url":"https://github.com/fuel/core/issues/1836","id":58672178,"number":1836,"title":"[BEST PRACTICES] CSRF failures should issue a 400 code, not 500.","user":{"login":"CozyLife","id":8941225,"avatar_url":"https://avatars.githubusercontent.com/u/8941225?v=3","gravatar_id":"","url":"https://api.github.com/users/CozyLife","html_url":"https://github.com/CozyLife","followers_url":"https://api.github.com/users/CozyLife/followers","following_url":"https://api.github.com/users/CozyLife/following{/other_user}","gists_url":"https://api.github.com/users/CozyLife/gists{/gist_id}","starred_url":"https://api.github.com/users/CozyLife/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/CozyLife/subscriptions","organizations_url":"https://api.github.com/users/CozyLife/orgs","repos_url":"https://api.github.com/users/CozyLife/repos","events_url":"https://api.github.com/users/CozyLife/events{/privacy}","received_events_url":"https://api.github.com/users/CozyLife/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-02-24T00:09:57Z","updated_at":"2015-02-24T00:09:57Z","closed_at":null,"body":"CSRF validation fails due to the client sending the wrong CSRF cookie, or not sending one at all. Therefore the error occurs on the client side, not the server-side. As the server is doing what it should be (denying crap requests), consider sending a 400 Bad Request instead of a 500 Server Error."}}