Skip to content

v0.2.0 - Ruby/dependency updates + GET params fix - #131

Merged
benliscio merged 2 commits into
masterfrom
eng-4289-investigate-waf-blocking-gemini-legal-api-
Mar 24, 2026
Merged

v0.2.0 - Ruby/dependency updates + GET params fix#131
benliscio merged 2 commits into
masterfrom
eng-4289-investigate-waf-blocking-gemini-legal-api-

Conversation

@BrianBorge

@BrianBorge BrianBorge commented Mar 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

  • Fix: GET requests were sending parameters as a request body payload, which caused the WAF to block them (403). Params are now sent as URL query string parameters for GET requests, while POST/PATCH/DELETE behavior is unchanged.
  • Update Ruby and dependencies (from PR ENG-1869 - Bump bundler to v2 #130)
  • Add VCR cassette for attachment response and prevent recording new episodes
  • Version bump: 0.1.7 → 0.2.0 (0.1.8 was never released; 0.1.9 was the Ruby 2 hotfix)

Test plan

  • All 2501 specs pass on Ruby 3.2
  • GET params fix verified by client_get_request_params_spec.rb
  • Manually tested against local dev server

Linear issue: https://linear.app/daisybill/issue/ENG-4289/investigate-waf-blocking-gemini-legal-api-requests

@BrianBorge BrianBorge self-assigned this Mar 23, 2026
@BrianBorge
BrianBorge force-pushed the eng-4289-investigate-waf-blocking-gemini-legal-api- branch from eed5b97 to 984e771 Compare March 23, 2026 14:45
@BrianBorge
[#131] Fix GET requests sending params in body instead of query string
4a67201 
GET requests were including parameters as a request body payload, which
caused WAF to block them as anomalous. Params are now sent as URL query
string parameters for GET requests while preserving body payload behavior
for POST/PATCH/DELETE.

Bump version to 0.1.9.
@BrianBorge
BrianBorge force-pushed the eng-4289-investigate-waf-blocking-gemini-legal-api- branch from 984e771 to 4a67201 Compare March 23, 2026 14:48
@BrianBorge
BrianBorge requested a review from baueric March 23, 2026 14:49
@BrianBorge
BrianBorge marked this pull request as ready for review March 23, 2026 14:49
@BrianBorge BrianBorge changed the title ENG-4289 - Investigate WAF blocking Gemini Legal API requests ENG-4289 - Investigate WAF blocking API requests Mar 23, 2026
@BrianBorge

BrianBorge commented Mar 23, 2026

Copy link
Copy Markdown
Contributor Author

Proof

Old Behavior 🔴

bundle exec ruby test_staging_old_behavior.rb
Testing OLD (broken) behavior against production (with WAF)
GET requests will send params in the request body (triggers WAF)
==================================================

[1] GET /claims_administrators
  FAILED: JSON::ParserError: unexpected token at '<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<TITLE>ERROR: The request could not be satisfied</TITLE>
</HEAD><BODY>
<H1>403 ERROR</H1>
<H2>The request could not be satisfied.</H2>
<HR noshade size="1px">
Bad request.
We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.
<BR clear="all">
If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.
<BR clear="all">
<HR noshade size="1px">
<PRE>
Generated by cloudfront (CloudFront)
Request ID: uZ286N3mof-wq63rdECrvR5bJeurIpmqA7PbsYFnzj3sowsKuH7O_A==
</PRE>
<ADDRESS>
</ADDRESS>
</BODY></HTML>'

[2] GET /claims_administrators/{id}/payers
  FAILED: JSON::ParserError: unexpected token at '<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<TITLE>ERROR: The request could not be satisfied</TITLE>
</HEAD><BODY>
<H1>403 ERROR</H1>
<H2>The request could not be satisfied.</H2>
<HR noshade size="1px">
Bad request.
We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.
<BR clear="all">
If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.
<BR clear="all">
<HR noshade size="1px">
<PRE>
Generated by cloudfront (CloudFront)
Request ID: zabY0rLD6J20Dneuh8wZ9TdfusQjVr9zrYW-yJMOjMncovh0RrSVWQ==
</PRE>
<ADDRESS>
</ADDRESS>
</BODY></HTML>'

[3] GET /billing_providers
  SUCCESS: Got 1 billing providers

New Behavior 🟢


bundle exec ruby test_staging.rb
Testing against https://go.daisybill.com (with WAF)
==================================================

[1] GET /claims_administrators
  SUCCESS: Got 25 claims administrators

[2] GET /claims_administrators/25228/payers
  SUCCESS: Got 0 payers

[3] GET /billing_providers
  SUCCESS: Got 1 billing providers

baueric
baueric reviewed Mar 23, 2026
View reviewed changes
Comment thread lib/daisybill_api/version.rb Outdated
@BrianBorge @claude
Bump version to 0.2.0 and update changelog
2d5fbff 
0.1.9 was released as a hotfix on the v0.1.7 branch for Ruby 2
consumers. This branch (off master) includes the Ruby/dependency
updates from PR #130 plus the GET params fix, released as 0.2.0.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@BrianBorge BrianBorge changed the title ENG-4289 - Investigate WAF blocking API requests v0.2.0 - Ruby/dependency updates + GET params fix Mar 24, 2026
@benliscio
benliscio merged commit 93955cc into master Mar 24, 2026
1 check passed
@BrianBorge BrianBorge mentioned this pull request Mar 24, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@baueric baueric baueric left review comments

Assignees

@BrianBorge BrianBorge

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@BrianBorge @baueric @benliscio