975214 - "Disable" Hawk timestamp and nonce checking

Status: VERIFIED FIXED

(Cloud Services Graveyard :: Server: Sync, defect)

Description

[Ryan Kelly [:rfkelly]]

(copy of https://github.com/mozilla/fxa-auth-server/issues/578)

This isn't buying us that much and there's reason to believe it's causing failures and retries. Let's put it in "warn" mode for now and measure what's going on:

    Set the time window to something large, e.g., 20 years
    Disable the nonce replay checks
    Log all timestamp deltas so we can build a distribution of these deltas

Comment 1

[Richard Newman [:rnewman]]

This is relevant to my interests. Please subscribe me to your newsletter.

Comment 2

[Ryan Kelly [:rfkelly]]

Attachment: mozsvc-permissive-nonce-cache.diff

This patch creates a PermissiveNonceCache class that will not actually check the timestamps or nonces, just log them if they seem to be too highly skewed.

Comment 3

[Ryan Kelly [:rfkelly]]

https://github.com/mozilla-services/mozservices/commit/d037cab18cbf1635b2da12847dd06660afd7a0ea

Comment 4

[James Bonacci [:jbonacci]]

Any QA required here or just a code fix verification?

Comment 5

[Ryan Kelly [:rfkelly]]

Code fix verification fine here, additional verification discussion in Bug 975001

Comment 6

[James Bonacci [:jbonacci]]

Verified in code.