Gehel has submitted this change and it was merged.

Change subject: Set up outgoing request filter config.
......................................................................


Set up outgoing request filter config.

In https://github.com/wikimedia/hyperswitch/pull/29 hyperswitch
was changed to require external configuration of the outgoing request
filter. This patch adds the config that restricts header forwarding
only to parsoid and MW API, although allowing any other outgoing request,
but without headers (and especially cookie) forwarding.

Currently this is a no-op until the next RESTBase code deployment.

Change-Id: I860066c9291794daf76c2c7c910523bde4868aa5
---
M modules/restbase/templates/config.labs.yaml.erb
M modules/restbase/templates/config.yaml.erb
2 files changed, 20 insertions(+), 0 deletions(-)

Approvals:
  Gehel: Looks good to me, approved
  jenkins-bot: Verified



diff --git a/modules/restbase/templates/config.labs.yaml.erb 
b/modules/restbase/templates/config.labs.yaml.erb
index 2fc2832..3541d88 100644
--- a/modules/restbase/templates/config.labs.yaml.erb
+++ b/modules/restbase/templates/config.labs.yaml.erb
@@ -54,6 +54,16 @@
 root_spec: &root_spec
   title: "The RESTBase root"
   # Some more general RESTBase info
+  x-sub-request-filters:
+    - type: default
+      name: http
+      options:
+        allow:
+          - pattern: /^https?:\/\/[a-zA-Z0-9\.]+\/w\/api\.php/
+            forward_headers: true
+          - pattern: <%= @parsoid_uri %>
+            forward_headers: true
+          - pattern: /^https?:\/\//
   paths:
     # list taken from Parsoid's beta config
     /{domain:aa.wikipedia.beta.wmflabs.org}: *default_project
diff --git a/modules/restbase/templates/config.yaml.erb 
b/modules/restbase/templates/config.yaml.erb
index 2f9ce83..7b799c9 100644
--- a/modules/restbase/templates/config.yaml.erb
+++ b/modules/restbase/templates/config.yaml.erb
@@ -82,6 +82,16 @@
 root_spec: &root_spec
   title: "The RESTBase root"
   # Some more general RESTBase info
+  x-sub-request-filters:
+    - type: default
+      name: http
+      options:
+        allow:
+          - pattern: http://api.svc.<%= mw_primary %>.wmnet/w/api.php
+            forward_headers: true
+          - pattern: <%= @parsoid_uri %>
+            forward_headers: true
+          - pattern: /^https?:\/\//
   paths:
 
     # wikipedia

-- 
To view, visit https://gerrit.wikimedia.org/r/277836
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings

Gerrit-MessageType: merged
Gerrit-Change-Id: I860066c9291794daf76c2c7c910523bde4868aa5
Gerrit-PatchSet: 3
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Ppchelko <[email protected]>
Gerrit-Reviewer: Eevans <[email protected]>
Gerrit-Reviewer: GWicke <[email protected]>
Gerrit-Reviewer: Gehel <[email protected]>
Gerrit-Reviewer: Mobrovac <[email protected]>
Gerrit-Reviewer: jenkins-bot <>

_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits

Reply via email to