eyre: do not store localhost as eauth-url #6929
Conversation
9049278 to
26bc23a
Compare
26bc23a to
630d5d0
Compare
|
imo this logic should only be applied if Also it should probably short-circuit on a True equality check between |
Fang-
left a comment
There was a problem hiding this comment.
Also it should probably short-circuit on a True equality check between
(cat 3 ?:(secure 'https://' 'http://') u.host)andu.auth.endpoint.auth.statecos parsers are slow & this will be run on every request despite 99.9% of them having the same host
Except the code here only runs for every login attempt, not every request in general. It's fine.
I do agree that we should be more "eager" in cases where we don't yet have a known public url yet at all. Even in cases where this is undesired, at least it'll be clearly wrong ("i got redirected to localhost!") instead of subtly wrong ("it didn't redirect me at all!").
(This eagerness is probably redundant in practice, considering we already eagerly accept the endpoint from any authenticated request in that scenario, but sharing that intent/behavior here is more consistent.)
Matching suggestion below.
Co-authored-by: fang <[email protected]>
3a65abb to
0950389
Compare
0950389 to
bf60b47
Compare
Tlon hosting has a login health check that regularly logs into the ship using the
+code. This login happens from a sidecar and therefore thrashes the eauth-url with localhost constantly. This causes ships on Tlon hosting to have unreliable eauth currently.Disallowing localhost as the eauth-url seems like the simplest solution to me.