Problem/Motivation

It's possible to break access to the metrics route when it's requested from a not-allowed IP: access denied persists after request from wrong IP. Timings indicate that the following access denieds are a page cache hit.

Steps to reproduce

1. Enable monitoring_prometheus and set "allowed_ips" to exclude your own IP.
2. Request /metrics - get a 403, cacheable by Internal Page Cache.
3. cHECK the response's X-Drupal-Cache header

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Issue fork monitoring-3612040

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

primsi created an issue. See original summary.

primsi opened merge request !56

berdir’s picture

berdir
Primary language German
Location Switzerland
commented
Status: Active » Fixed

Merging.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

  • berdir committed af359a2f on 8.x-1.x authored by primsi 
    fix: #3612040 Access denied on IP-limited /metrics route is cached

By:...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.