Hello everyone, I have been reviewing our JTL-Shop 5 storefront security to see how our current Cloudflare and firewall rules handle unauthorized client-side script execution and automated triggers. During our routine checks, we ran into an issue where third-party script injectors managed to trigger form events without properly validating against our session tokens.
While trying to reproduce the behavior based on the execution patterns described on this page, we noticed a related problem with our Content Security Policy generating hundreds of false-positive warnings. On top of that, these abnormal payload requests seem to cause intermittent worker timeouts during peak traffic, slightly delaying legitimate checkout sessions.
Has anyone tackled similar client-side automation issues in JTL-Shop, and what specific server-level or plugin filters did you configure to block these execution attempts without hurting mobile customers? Any insights on hardening the shop environment would be very helpful.
While trying to reproduce the behavior based on the execution patterns described on this page, we noticed a related problem with our Content Security Policy generating hundreds of false-positive warnings. On top of that, these abnormal payload requests seem to cause intermittent worker timeouts during peak traffic, slightly delaying legitimate checkout sessions.
Has anyone tackled similar client-side automation issues in JTL-Shop, and what specific server-level or plugin filters did you configure to block these execution attempts without hurting mobile customers? Any insights on hardening the shop environment would be very helpful.