Skip to content

Make sure to load a fresh copy of the phishing configuration#297

Merged
danfinlay merged 4 commits intoMetaMask:developfrom
btchip:phishing-cache-refresh
Nov 17, 2020
Merged

Make sure to load a fresh copy of the phishing configuration#297
danfinlay merged 4 commits intoMetaMask:developfrom
btchip:phishing-cache-refresh

Conversation

@btchip
Copy link
Copy Markdown
Contributor

@btchip btchip commented Nov 8, 2020

I've noticed that the phishing configuration could be fetched from the disk cache in Chrome due to the initial cache policy when it's fetched for the first time - this makes sure that polling will be done over the network to have a fresh copy.

@btchip btchip requested a review from a team as a code owner November 8, 2020 22:24
Copy link
Copy Markdown
Member

@Gudahtt Gudahtt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wouldn't this always skip the cache? Not just upon initialization, but on every request.

It seems that the default cache mode used here is no-cache, which already seems ideal here. From the MDN docs:

The browser looks for a matching request in its HTTP cache.

  • If there is a match, fresh or stale, the browser will make a conditional request to the remote server. If the server indicates that the resource has not changed, it will be returned from the cache. Otherwise the resource will be downloaded from the server and the cache will be updated.
  • If there is no match, the browser will make a normal request, and will update the cache with the downloaded resource.

This should guarantee that we're getting an up-to-date copy, even if there is a cached copy.

@danfinlay
Copy link
Copy Markdown
Contributor

Closing per @Gudahtt's feedback.

@danfinlay danfinlay closed this Nov 9, 2020
@danfinlay danfinlay reopened this Nov 17, 2020
@danfinlay danfinlay merged commit c6fcb22 into MetaMask:develop Nov 17, 2020
Gudahtt added a commit to MetaMask/metamask-extension that referenced this pull request Dec 17, 2020
This update comes with a breaking change to the Approval controller. It
now requires a `defaultApprovalType` parameter.

I don't think we have any use for a default approval type, but I've
added a "NO_TYPE" one for now because it's a strict requirement. We
should consider making this parameter optional in the future, for cases
like this where it's not needed.

This update will hopefully address some caching issues we've been
seeing with our phishing configuration. See here for more details:
MetaMask/core#297
@Gudahtt
Copy link
Copy Markdown
Member

Gudahtt commented Dec 17, 2020

It seems I was mistaken about the default behaviour. By default fetch it will use any existing browser cache, as long as the cache is "fresh", which it is for quite a while in this case.

The change made in this PR (using cache mode no-cache) should guarantee that a conditional request is sent each time though. So I think this change was required, and this does fix the problem.

Note that even with this change, the phishing config is still cached for long periods on the server. This will only prevent stale client caches. But it's a start!

Gudahtt added a commit to MetaMask/metamask-extension that referenced this pull request Dec 17, 2020
This update comes with a breaking change to the Approval controller. It
now requires a `defaultApprovalType` parameter.

I don't think we have any use for a default approval type, but I've
added a "NO_TYPE" one for now because it's a strict requirement. We
should consider making this parameter optional in the future, for cases
like this where it's not needed.

This update will hopefully address some caching issues we've been
seeing with our phishing configuration. See here for more details:
MetaMask/core#297
Gudahtt added a commit to MetaMask/metamask-extension that referenced this pull request Dec 17, 2020
This update comes with a breaking change to the Approval controller. It
now requires a `defaultApprovalType` parameter.

I don't think we have any use for a default approval type, but I've
added a "NO_TYPE" one for now because it's a strict requirement. We
should consider making this parameter optional in the future, for cases
like this where it's not needed.

This update will hopefully address some caching issues we've been
seeing with our phishing configuration. See here for more details:
MetaMask/core#297
Gudahtt added a commit to MetaMask/metamask-extension that referenced this pull request Dec 18, 2020
This update comes with a breaking change to the Approval controller. It
now requires a `defaultApprovalType` parameter.

I don't think we have any use for a default approval type, but I've
added a "NO_TYPE" one for now because it's a strict requirement. We
should consider making this parameter optional in the future, for cases
like this where it's not needed.

This update will hopefully address some caching issues we've been
seeing with our phishing configuration. See here for more details:
MetaMask/core#297
MajorLift pushed a commit that referenced this pull request Oct 11, 2023
* Make sure to load a fresh copy of the configuration

* Update src/third-party/PhishingController.ts

* Update src/third-party/PhishingController.ts

Co-authored-by: Dan Finlay <542863+danfinlay@users.noreply.github.com>
MajorLift pushed a commit that referenced this pull request Oct 11, 2023
* Make sure to load a fresh copy of the configuration

* Update src/third-party/PhishingController.ts

* Update src/third-party/PhishingController.ts

Co-authored-by: Dan Finlay <542863+danfinlay@users.noreply.github.com>
Mrtenz added a commit that referenced this pull request Oct 16, 2025
This bumps `@metamask/utils` from `^9.1.0` to `^11.0.1`.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants