CDN bot protection blocks QA test runs

Open
  • Is something wrong?
#151 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 7 days

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
25/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
aws, github-actions, playwright
Domain
devops, security, testing

Research direction

The repo-side work is in .github/workflows/qa.yml, where the bypass secret and header name would be passed only to the Playwright test steps, plus the Playwright config, where traces must be disabled whenever the header is set and the header must be scoped to the site's own host. The AWS WAF rule and the secret setup belong to infra and repo admins and cannot be done from code. Done means a manual QA run against staging and prod returns no 403s, and traces stay off when the header is present.

Written by the indexing model from the issue text.

Description

What's wrong: strapi.io (prod and staging) is behind CloudFront + AWS WAF bot protection. After a burst of automated requests, it answers Playwright test traffic with HTTP 403 "Request blocked … Generated by cloudfront"; WebKit gets blocked almost immediately. Test runs then fail on blocked pages instead of on real issues (the tests now report "Unexpected HTTP status … 403"). CI and scheduled runs (.github/workflows/qa.yml) will hit the same.

Ask (infra / CDN owners): an AWS WAF rule that lets requests carrying a secret header through:

  • match header x-qa-bypass (name up to you) against a secret value
  • action Allow, placed before the bot-control and rate-based rules (or exclude matching requests from them via a scope-down statement)
  • on both CloudFront distributions, staging and prod
  • share the value with QA through a secure channel (not chat or Jira); rotate it if it leaks

An IP allowlist doesn't work well: GitHub-hosted runners don't have fixed IPs.

Ask (repo admins): GitHub → Settings → Secrets and variables → Actions:

  • secret CDN_BYPASS_HEADER_VALUE
  • variable CDN_BYPASS_HEADER_NAME, only if the header isn't x-qa-bypass
  • optionally, put the secret in a GitHub Environment restricted to staging and main

QA side (how the secret stays safe):

  • the header is only sent to our own host, never to third-party scripts (Cookiebot, Google, HubSpot, …)
  • only the test steps in qa.yml get it; the workflow is manual-only, and runs from forks never receive secrets
  • Playwright traces are disabled while it's set (they record headers and are uploaded as artifacts in our public repo); Lighthouse runs without it

Done when: a full QA run against prod and staging with the header gets no 403s.

Dominant language
TypeScript
Stars
6
Forks
5
Avg merge
5d 6h
Merged PRs (30d)
7

Getting set up

  • No Dockerfile or Docker Compose file
  • Has a pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from strapi/website

All issues in strapi/website

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.