1095161 - Rate limiting breaks when behind an ELB

Status: RESOLVED FIXED

(Webmaker Graveyard :: Login, defect)

Description

[Chris DeCairos (:cade)]

The webmaker auth middleware is trying to send along the source ip of a request as an x-forwarded-for header. 

This breaks when the login server itself is behind an ELB and overwrites that header with the source IP of the app server sending the request.

Comment 1

[Chris DeCairos (:cade)]

Attachment: https://github.com/mozilla/webmaker-auth/pull/18

Comment 2

[Chris DeCairos (:cade)]

Attachment: https://github.com/mozilla/login.webmaker.org/pull/308

Comment 3

[Jon Buckley [:jbuck]]

Comment on attachment 8518504 [details] [review]
https://github.com/mozilla/webmaker-auth/pull/18

r+, but when you tag this, make sure it's a major version change since you removed some API bits.

Comment 4

[Chris DeCairos (:cade)]

This is working, but better handling needs to be added to the webmaker-auth handlers so that 429's are properly forwarded to the client.

Comment 5

[Chris DeCairos (:cade)]

Attachment: https://github.com/mozilla/webmaker-auth/pull/19

Comment 6

[Chris DeCairos (:cade)]

updated apps: webmakerorg, events, profile

todo: popcorn, thimble, goggles, appmaker

Comment 7

[Chris DeCairos (:cade)]

All apps on staging now have the rate limiting fix in place!