972101 - reviewer attachments over xsendfile redirects to cdn, throwing a 403

Status: VERIFIED FIXED

(Cloud Services :: Operations: Marketplace, task, P1)

Description

[Kevin Ngo [:ngoke]]

We have an API that sends an xsendfile response with an internal file in NETAPP_STORAGE + UPLOADS_PATH + /reviewer_attachment. However, nginx redirects to the CDN where the file doesn't exist, throwing 403.

23:48:57 ngoke | hey jason, i'm trying to get x-sendfile working on -dev for attachments. the files are uploaded to NETAPP_STORAGE + UPLOADS_PATH + /reviewer_attachment
23:49:30 ngoke | the download endpoint urls look something like https://marketplace-dev.allizom.org/api/v1/comm/note/31/attachment/3
23:49:59 ngoke | but i get redirected to the https://marketplace-dev-cdn.a.o/<URI>
23:50:27 ngoke | so we need to update the nginx configs

00:20:57 jason | i'm assuming you don't ever want this content to be served via cdn
00:23:14 ngoke | yeah, needs to be behind permissions
00:23:45 ngoke | i'm not seeing the xsendfile header in the response when hitting that url, maybe a code problem
00:25:47 jason | I see it from the server
00:26:18 jason | https://jason.pastebin.mozilla.org/4272416
00:27:18 jason | so it looks like it is set correctly, however our nginx configuration rewrites specific static assets in  in the marketplace-dev.allizom.org domain to cdn
00:27:28 jason | so there is some weirdness going on there

Comment 1

[Kevin Ngo [:ngoke]]

Is https://github.com/mozilla-services/svcops-puppet/blob/03cfe9f36dcc36f316e514a130bfd46b33bc5c41/modules/marketplace/templates/nginx/marketplace.conf#L293 causing the redirect? Can we exclude reviewer attachments from that pattern?

Comment 2

[Jason Thomas [:jason]]

https://github.com/mozilla-services/svcops-puppet/commit/67675044c91808eba6236d6b17c2fef8a44d90e6

Comment 3

[Iulian Timis]

Thank you Kevin!
Verified as fixed in https://marketplace-dev.allizom.org/comm/ on FF30 (Win 7).
Postfix screencast http://screencast.com/t/sOCeBRmdYAeK
Closing bug.

Comment 4

[Kevin Ngo [:ngoke]]

Is this configured for prod as well?

Comment 5

[Jason Thomas [:jason]]

Yes.