CDN bot protection blocks QA test runs

Aperta
  • Qualcosa non va?
#151 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 7 giorni

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
25/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
aws, github-actions, playwright
Ambito
devops, security, testing

Direzione di ricerca

The repo-side work is in .github/workflows/qa.yml, where the bypass secret and header name would be passed only to the Playwright test steps, plus the Playwright config, where traces must be disabled whenever the header is set and the header must be scoped to the site's own host. The AWS WAF rule and the secret setup belong to infra and repo admins and cannot be done from code. Done means a manual QA run against staging and prod returns no 403s, and traces stay off when the header is present.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

What's wrong: strapi.io (prod and staging) is behind CloudFront + AWS WAF bot protection. After a burst of automated requests, it answers Playwright test traffic with HTTP 403 "Request blocked … Generated by cloudfront"; WebKit gets blocked almost immediately. Test runs then fail on blocked pages instead of on real issues (the tests now report "Unexpected HTTP status … 403"). CI and scheduled runs (.github/workflows/qa.yml) will hit the same.

Ask (infra / CDN owners): an AWS WAF rule that lets requests carrying a secret header through:

  • match header x-qa-bypass (name up to you) against a secret value
  • action Allow, placed before the bot-control and rate-based rules (or exclude matching requests from them via a scope-down statement)
  • on both CloudFront distributions, staging and prod
  • share the value with QA through a secure channel (not chat or Jira); rotate it if it leaks

An IP allowlist doesn't work well: GitHub-hosted runners don't have fixed IPs.

Ask (repo admins): GitHub → Settings → Secrets and variables → Actions:

  • secret CDN_BYPASS_HEADER_VALUE
  • variable CDN_BYPASS_HEADER_NAME, only if the header isn't x-qa-bypass
  • optionally, put the secret in a GitHub Environment restricted to staging and main

QA side (how the secret stays safe):

  • the header is only sent to our own host, never to third-party scripts (Cookiebot, Google, HubSpot, …)
  • only the test steps in qa.yml get it; the workflow is manual-only, and runs from forks never receive secrets
  • Playwright traces are disabled while it's set (they record headers and are uploaded as artifacts in our public repo); Lighthouse runs without it

Done when: a full QA run against prod and staging with the header gets no 403s.

Lingua principale
TypeScript
Stelle
6
Fork
5
Merge medio
5g 6h
PR unite (30g)
7

Preparare l'ambiente

  • Nessun Dockerfile né file Docker Compose
  • Ha un modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di strapi/website

Tutte le issue di strapi/website

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.