886272 - (production) Marketplace CDN responding to /files/browse URLs with 403

Status: RESOLVED FIXED

(Marketplace Graveyard :: Reviewer Tools, defect, P2)

Description

[Andrew Williamson [:eviljeff]]

each file in the file viewer has a download load.  Trying it gives a server error.

Comment 1

[Matt Basta [:basta]]

The Marketplace is redirecting to the CDN appropriately (with a ?token= query string parameter) but the CDN is responding with a 403 (at least on -dev, can't test on prod). Looks like an OPs issue.

See

https://marketplace-dev-cdn.allizom.org/files/browse/206643/file-serve/icons/16.png?token=5ff41e36-d0a1-4b6b-80a2-b9e7787e45d6

Comment 2

[Andrew Williamson [:eviljeff]]

yeah, its a 403 on prod too.  
e.g. https://marketplace.cdn.mozilla.net/files/browse/210984/file-serve/manifest.webapp?token=5dbf0456-f5f4-4c00-a1d0-da88ee27fc0c

re: the regression keyword - I never actually saw it working on marketplace.

Comment 3

[Matt Basta [:basta]]

It was originally working when the file viewer first launched; I did a demo of it at the show and tell.

This may also be the cause of bug 886273; the file viewer will show a two-up of an image when in Compare mode if the image has changed, but the image(s) uses the same URL as the download link.

Comment 4

[Jeremy Orem [:oremj]]

/files/browse has always been blocked on the CDN.

The file-serve URL currently allowed is:

  location ~ /[\w-]+/\w+/files/browse/\d+/file-serve/ {
        try_files $uri @zamboni;
    }

Comment 5

[Matt Basta [:basta]]

(In reply to Jeremy Orem [:oremj] from comment #4)
> /files/browse has always been blocked on the CDN.
> 
> The file-serve URL currently allowed is:
> 
>   location ~ /[\w-]+/\w+/files/browse/\d+/file-serve/ {
>         try_files $uri @zamboni;
>     }

What is the /[\w-]+/\w+/ supposed to correspond to?

Comment 6

[Jeremy Orem [:oremj]]

Looks like it is /{locale}/{firefox,...}/files/browse/

Comment 7

[Matt Basta [:basta]]

For Marketplace we don't need either of those, so we can safely route to just /files/browse/...

Comment 8

[Jeremy Orem [:oremj]]

/files/browse is no longer blocked on the CDN.

Comment 9

[Matt Basta [:basta]]

Looks good, thanks guys

Comment 10

[Andrew Williamson [:eviljeff]]

Still failing for me on prod and dev.

Comment 11

[Matt Basta [:basta]]

Andrew: The URLs in this bug have all expired, so those will implicitly not work. Have you tried using the file viewer from the reviewer tools?

Comment 12

[Andrew Williamson [:eviljeff]]

(In reply to Matt Basta [:basta] from comment #11)
> Andrew: The URLs in this bug have all expired, so those will implicitly not
> work. Have you tried using the file viewer from the reviewer tools?

yes.  I tried a random packaged app in the queue and tried to download the manifest file.

Comment 13

[Matt Basta [:basta]]

It isn't working for me now, as well. Any ideas?

Comment 14

[Jason Thomas [:jason]]

Could you provide a sample URL for testing?

Comment 15

[Andrew Williamson [:eviljeff]]

From https://marketplace.firefox.com/files/browse/210676/ (kitchen sink; approved version)

https://marketplace.firefox.com/files/browse/210676/file/manifest.webapp 
downloads
https://marketplace.cdn.mozilla.net/files/browse/210676/file-serve/manifest.webapp?token=c86d3c96-bbac-41a4-aff9-ed9ca8516010

Comment 16

[Jason Thomas [:jason]]

You should now be able to download the manifest file on -dev. I tested with https://marketplace-dev.allizom.org/files/browse/215049/file/manifest.webapp

Let me know if there are any issues. Once verified I can push the change out to prod.

Comment 17

[Andrew Williamson [:eviljeff]]

The manifest file works but I tried some of the other files in the same app and they return 404s (well, a Marketplace 'Page Not Found' page) e.g.
https://marketplace-dev.allizom.org/files/browse/215049/file/icons/256.png
https://marketplace-dev.allizom.org/files/browse/215049/file/script.js

from some testing with other apps it seems to dependant on the type of file.  html, xml, json work; js, png don't.

Comment 18

[Jason Thomas [:jason]]

I've made some additional nginx changes and it looks like it is working. Tested with https://marketplace-dev.allizom.org/files/browse/215049/file/script.js#top

Let me know if there are any issues.

Comment 19

[Andrew Williamson [:eviljeff]]

thanks!

Comment 20

[Andrew Williamson [:eviljeff]]

I spoke to soon on this - I verified it on -dev but not on prod.

c.f.
https://marketplace-dev.allizom.org/files/browse/210676/file/img/icons/logo-128.png
and
https://marketplace.firefox.com/files/browse/210676/file/img/icons/logo-128.png
(empty)

https://marketplace-dev-cdn.allizom.org/files/browse/210676/file-serve/img/icons/logo-128.png?token=1121d7dc-c284-4b21-a286-ba5ef5eadf9a
and
https://marketplace.cdn.mozilla.net/files/browse/210676/file-serve/img/icons/logo-128.png?token=dc889692-e47e-41bc-9d83-882de1844f93
(403)

Its the kitchen sink, v 0.2.2 in both cases.

Comment 21

[Jason Thomas [:jason]]

Are we still seeing this issue? I am not able to replicate on prod.

Comment 22

[Andrew Williamson [:eviljeff]]

looks like its working now.