{"action":"closed","issue":{"url":"https://api.github.com/repos/TykTechnologies/tyk/issues/1297","repository_url":"https://api.github.com/repos/TykTechnologies/tyk","labels_url":"https://api.github.com/repos/TykTechnologies/tyk/issues/1297/labels{/name}","comments_url":"https://api.github.com/repos/TykTechnologies/tyk/issues/1297/comments","events_url":"https://api.github.com/repos/TykTechnologies/tyk/issues/1297/events","html_url":"https://github.com/TykTechnologies/tyk/issues/1297","id":274649982,"number":1297,"title":"If beginning of a random path of api call matches an existing slug we return 403 (instead of 404.)","user":{"login":"letzya","id":3155222,"avatar_url":"https://avatars1.githubusercontent.com/u/3155222?v=4","gravatar_id":"","url":"https://api.github.com/users/letzya","html_url":"https://github.com/letzya","followers_url":"https://api.github.com/users/letzya/followers","following_url":"https://api.github.com/users/letzya/following{/other_user}","gists_url":"https://api.github.com/users/letzya/gists{/gist_id}","starred_url":"https://api.github.com/users/letzya/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/letzya/subscriptions","organizations_url":"https://api.github.com/users/letzya/orgs","repos_url":"https://api.github.com/users/letzya/repos","events_url":"https://api.github.com/users/letzya/events{/privacy}","received_events_url":"https://api.github.com/users/letzya/received_events","type":"User","site_admin":false},"labels":[{"id":97816682,"url":"https://api.github.com/repos/TykTechnologies/tyk/labels/bug","name":"bug","color":"fc2929","default":true}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2017-11-16T20:17:48Z","updated_at":"2017-11-21T16:17:13Z","closed_at":"2017-11-21T16:17:13Z","author_association":"NONE","body":"**Do you want to request a *feature* or report a *bug*?**\r\nBug\r\n**What is the current behavior?**\r\n`http://my-instance.com:8080/api1 works`, but\r\n`http://my-tyk-instance.com:8080/api1ss` (i.e. adding some letters at the end of the slug) generates  **403 forbidden** while putting some string right after the hostname `http://my-tyk-instance.com:8080/ss` just gives `404 page not found`\r\n**What is the expected behavior?**\r\nhttp://my-tyk-instance.com:8080/api1ss ==> should return 404\r\n\r\n\r\n**If the current behavior is a bug, please provide the steps to reproduce and if possible a minimal demo of the problem**\r\n1. create api\r\n2. make a call to it, check it's fine\r\n3. make a call with some extra chars at the end.\r\n**Which versions of Tyk affected by this issue? Did this work in previous versions of Tyk?**\r\n2.3"}}
{"actor":{"display_login":"mvdan"}}