Nils Goroll 🕊️:vinylcache:slink@fosstodon.org

Oct 21, 2026, 8:36 PM

So one option in #Vinyl_Cache is to check if you have any such requests:

vinyllog -dCq 'ReqHeader:Content-Type ~ multipart/form'
vinyllog -Cq 'ReqHeader:Content-Type ~ multipart/form'

The first command scans the in-memory log, the second runs until interrupted on live data.

If you do not see multipart/form-data requests, you can simply refuse them in VCL.

$# php2shell sub recv_no_multipart { if (! req.http.Content-Length && ! req.http.Transfer-Encoding) { return; } if (req.http.Content-Type ~ "(?i)^multipart/form-data") { return (synth(415)); } } sub vcl_recv { call recv_no_multipart; # ...$