Problem/Motivation

See #3348789: Compress ajax_page_state for discussion.

media_library adds media_library.opener params to query parameters, including duplicate ones, leading to massive URLs like this:

https://dev.www.my-test-site.com/testing/views/ajax?ajax_form=1&_wrapper_format=drupal_ajax&media_library_opener_id=media_library.opener.field_widget&media_library_allowed_types%5Bimage%5D=image&media_library_selected_type=image&media_library_remaining=1&media_library_opener_parameters%5Bfield_widget_id%5D=field_media_image%3A-field_paragraph_band-0-subform&media_library_opener_parameters%5Bentity_type_id%5D=paragraph&media_library_opener_parameters%5Bbundle%5D=page_header&media_library_opener_parameters%5Bfield_name%5D=field_media_image&media_library_opener_parameters%5Bentity_id%5D=725&media_library_opener_parameters%5Brevision_id%5D=797&hash=MdCytfJWxVGpEfN1LYH6YKwhAuiPKz_o-u8JaIl7hyY&_wrapper_format=drupal_ajax&view_name=media_library&view_display_id=widget&view_args=image&view_path=%2Fnode%2F105%2Fedit&view_base_path=admin%2Fcontent%2Fmedia-widget&view_dom_id=5d0e1f479c58d847ab8977967424d7ed258a264e1a11b05cc3b3abb68e179991&pager_element=0&ajax_form=1&_wrapper_format=drupal_ajax&media_library_opener_id=media_library.opener.field_widget&media_library_allowed_types%5Bimage%5D=image&media_library_selected_type=image&media_library_remaining=1&media_library_opener_parameters%5Bfield_widget_id%5D=field_media_image%3A-field_paragraph_band-0-subform&media_library_opener_parameters%5Bentity_type_id%5D=paragraph&media_library_opener_parameters%5Bbundle%5D=page_header&media_library_opener_parameters%5Bfield_name%5D=field_media_image&media_library_opener_parameters%5Bentity_id%5D=725&media_library_opener_parameters%5Brevision_id%5D=797&hash=MdCytfJWxVGpEfN1LYH6YKwhAuiPKz_o-u8JaIl7hyY&page=1&_drupal_ajax=1&ajax_page_state%5Btheme%5D=framework_admin_theme&ajax_page_state%5Btheme_token%5D=SD2fJyW4XLNuU287foru_6-9lT9JjPOl_P1bY9BT7NA&ajax_page_state%5Blibraries%5D=eJx9lH2aozAIxi-UxjPsSXxQUTNNghuInc7pFz-iY2en_yj8XkgpYKALLtZC5BtI1f62khAN_CrZkWZMLgpGuYatbz6CXUvRNET3qkt5Am8X27R37JxQKrD4vwp28nlwke3Gg1IwrYdEJTLCfBNoeKeDpwb8jeXpXRx2uKbV3jUJ0tPKiAF3JVKHt55SMC15Sg19Vh32kL0coHZRj8LqxT91dmHyWHuCrloeqiQs5UErbsabZtyvPAu1tCQKXgQ91sPEV6jddvIshZ78B2ABQb4gbY7HLsHwkybkiSJrgZu2zDVFVT_-ZtROncdHtcC7LzTXOe3j-x-02nNPg-mdP-tVewH6M9-QeqanKPBApoDVN9vyPLzTLI8umHW--5QxNNjVZX_qbdiXBaiyewEP1w0oZlmGY63U3sDaBGr6zK32Vs8H548lmUAbm2AauSSeZJ29tvd9UKAO_PuQvbwJZDxVGVew7FGpP-mfSthKCSq-XT9UwyMlafMhF9_wkwVDtUdtTgO6gi83wKtvUVsy4Z81TygvQk4mB2Cu-wQBH5Tu9X5NLIMon2fLbDKfS7DY65XBZnb44Gp9WviAzwvQZmWP_wAsB9ZA

Steps to reproduce

Proposed resolution

1. Find out why it's duplicated and ensure that doesn't happen, might need a change in MediaLibraryState
2. Look at compressing this the same way ajax_page_state is compressed. The current code includes serialized PHP, so we could probably replace that with json_encode() too which would be an improvement in itself.
3. If for some reason it's still massive, look at other options like storing state in temp store.

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

CommentFileSizeAuthor
#14 3403077-14.patch24.43 KBadebruin

Issue fork drupal-3403077

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

catch created an issue. See original summary.

bkosborne’s picture

bkosborne
Primary language English
Location New Jersey, USA
commented

I think I ran into this today. Received reports that someone could not browse past the 2nd page of a media library when browsing from the widget. I observed that the request header size grew to over 8kb which was the limit in Varnish. Inspecting the request, I see that a ton of the query string parameters are being duplicated on each page load.

bkosborne’s picture

bkosborne
Primary language English
Location New Jersey, USA
commented

I just spent an hour trying to figure out why duplicate params are being added. I still have no idea unfortunately. Paging through the media library directly (outside of the field widget) doesn't cause the duplicates issue. It's just within the media library widget. So I have to think it's something in either media_library.view.js or media_library.widget.js, but I can't find any obvious places to start debugging.

I guess this is less of a problem on 10.2.x because the libraries param of the ajax page state is compressed, but I don't plan to upgrade our sites to 10.2.x for a couple more months.

catch’s picture

catch
he/him
Primary language English
commented
Related issues: +#3399951: ajax_page_state leaks through request in Views Ajax, +#2508796: Query string is appended multiple time after each AJAX request

Adding a couple of related issues.

acbramley’s picture

acbramley commented

I've just run into this with a client as well, this is on Drupal 10.3.2 (also reproducible on 10.2.6). It only happens on AWS environments and only when editing a node, not adding. Exposed filters work fine as well as exposed sorts.

The difference between editing and adding a node is down to query param length

When editing a node the query param is 2162 characters long
When adding a node the query param is 1938 characters long

This is referring to the number of characters appearing after /views/ajax? when clicking a pagination link in the media library on the above mentioned screens

kwinten-hardies’s picture

kwinten-hardies commented

I have exactly the same issue as acbramley. Tested on 10.4.9 and 10.5.8 . Also the same issue exists on 11.1.2. Our Web application firewall breaks the site because the parameters are more than 2048 characters. Has anyone a fix for this?

cilefen’s picture

cilefen commented

Is #3421255: Pager with ajax on Media Library makes longer pagination URL, getting blocked by AWS WAF a duplicate?

nod_’s picture

nod_
Primary language French
Location Lille
commented

For the future there is some discussion at the http level of adding a new verb: QUERY, essentially a GET with a body: https://httpwg.org/http-extensions/draft-ietf-httpbis-safe-method-w-body... not an immediate fix but could be useful in a few years.

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.

quietone’s picture

quietone commented

In #bugsmash @acbramley agreed that #3421255: Pager with ajax on Media Library makes longer pagination URL, getting blocked by AWS WAF is a duplicate. Therefore I have closed that issue as a duplicate. However, there is an MR over there that the should be considered.

adebruin made their first commit to this issue’s fork.

adebruin opened merge request !16172

adebruin’s picture

adebruin commented

We have added an MR which is based on this MR of the duplicate issue.

What we do is further decrease the size of the library string by replacing the library names with their indices. Creating a lookup map. For this we now have introduced a new Class which has a state because we do need the theme for getting the right set of libraries to create the map from.

For fetching the libraries we need to use the theme which does require us to postpone the execution of the AjaxPageState until after the Session has run which will give us the csrf token needed for validation the theme from the AjaxPageState settings.

While testing this solution we found another bug #3607112 where the theme in Ajax page state can be changed during an Ajax request. For this solution to work we should be able to rely on the fact that the theme can only be set ones and does not change with subsequent Ajax requests.

adebruin’s picture

adebruin commented
StatusFileSize
new 3403077-14.patch24.43 KB

This is a patch file of the latest state of the MR for save usage with composer patches.