HTTPRequest.Path.health: don't cache using ETagManager#2278
Merged
Conversation
Codecov Report
@@ Coverage Diff @@
## main #2278 +/- ##
==========================================
- Coverage 86.19% 86.19% -0.01%
==========================================
Files 186 186
Lines 12285 12303 +18
==========================================
+ Hits 10589 10604 +15
- Misses 1696 1699 +3
Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here. |
NachoSoto
commented
Feb 10, 2023
| expect(result?.value?.statusCode) == .success | ||
| } | ||
|
|
||
| func testCachedRequestsIncludeETagHeader() { |
Contributor
Author
There was a problem hiding this comment.
Turns out we didn't have tests for this!
tonidero
approved these changes
Feb 13, 2023
tonidero
left a comment
Contributor
There was a problem hiding this comment.
I think this makes sense though I do wonder if we should rate limit this API request if we are not caching it... If we rate limit it from the backend, I imagine it will fail for a bunch of people, but if they use it correctly, I expect it not to be an issue so I think this should be ok. CC @aboedo in case you have any thoughts.
Contributor
Author
|
Good point we have to be careful with that. One thing to note however is that the SDK will never make requests to this endpoint by itself. The only public API for it is |
aboedo
approved these changes
Feb 13, 2023
| expect(result?.value?.statusCode) == .success | ||
| } | ||
|
|
||
| func testCachedRequestsIncludeETagHeader() { |
This breaks signature validation in #2267 because `PurchasesDiagnostics` uses that endpoint with and without signature validation, so the first time it makes a request, it stores the cached response without a validated signature. The best solution is to simply not cache this endpoint, since it's used precisely to make sure that requests can be made with no errors, and we wouldn't want false positives.
da614e7 to
8595f7d
Compare
NachoSoto
pushed a commit
that referenced
this pull request
Feb 15, 2023
**This is an automatic release.** ### Bugfixes * `PurchaseOrchestrator`: always refresh receipt purchasing in sandbox (#2280) via NachoSoto (@NachoSoto) * `BundleSandboxEnvironmentDetector`: always return `true` when running on simulator (#2276) via NachoSoto (@NachoSoto) * `OfferingsManager`: ensure underlying `OfferingsManager.Error.configurationError` is logged (#2266) via NachoSoto (@NachoSoto) ### Other Changes * `UserDefaultsDefaultTests`: fixed flaky failures (#2284) via NachoSoto (@NachoSoto) * `BaseBackendTest`: improved test failure message (#2285) via NachoSoto (@NachoSoto) * Updated targets and schemes for Xcode 14.2 (#2282) via NachoSoto (@NachoSoto) * `HTTPRequest.Path.health`: don't cache using `ETagManager` (#2278) via NachoSoto (@NachoSoto) * `EntitlementInfos.all`: fixed docstring (#2279) via NachoSoto (@NachoSoto) * `StoreKit2StorefrontListener`: added tests to fix flaky code coverage (#2265) via NachoSoto (@NachoSoto) * `NetworkError`: added underlying error to description (#2263) via NachoSoto (@NachoSoto) * Created `Signing.verify(message:hasValidSignature:with:)` (#2216) via NachoSoto (@NachoSoto)
NachoSoto
added a commit
that referenced
this pull request
Feb 16, 2023
Depends on #2272 and #2278. Depends on https://github.com/RevenueCat/khepri/pull/5232.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This breaks signature validation in #2267 because
PurchasesDiagnosticsuses that endpoint with and without signature validation, so the first time it makes a request, it stores the cached response without a validated signature.The best solution is to simply not send etags for this endpoint, since it's used precisely to make sure that requests can be made with no errors, and we wouldn't want false positives.