|
Valid XHTML v1.0
Author Profile
Top Authors
Log In to set widget preferences
| Author | # |
|---|---|
|
185 |
|
|
148 |
Anonymous User
|
49 |
|
28 |
|
Kimberly Hieber
|
27 |
|
23 |
Note: some conversations may be proxied or secured, thereby causing # differences
Subscribe
Partners
Recent
Tags
Log In to set widget preferences
Recent
Log In to set widget preferences
Most Active
Log In to set widget preferences
Popular
Log In to set widget preferences
|
|
Removal of referral validation
belongs to Storage Service Info  by Jonathan Bell on 2008-08-01 09:58 PM read 342 times |
I've updated the storage service to remove the referral validation of incoming requests. Instead it now follows the standard pattern of checking for a BSGRA_GUID header, HTTP_BSGRA_GUID header, or a bsgra_guid parameter on the incoming request like the service_user. In addition it will validate the incoming bsgra_guid is valid and has access to the storage service in the provisions server, and that the incoming request is coming to an expected request url.
However, it is concerning that this make break clients of the storage server that are not currently passing the bsgra_guid in the request. Should we be handling backwards compatibility in regards to the referer mechanism? What sort of systems integration testing do we have for service interface updates?
3 Replies
|
Log In to Reply |
Log In to Copy |
Tell a Friend
|
Trackback URL: http://www.kalivo.com/trackback/1555-removal-of-referral-validation
|
|
|
re: Removal of referral validation
 a reply to Removal of referral validationby Brittain on 2008-08-05 02:50 PM read 77 times |
Good questions all. A few parts to my answer, then perhaps MarcS can answer also.
Other thoughts?
No current tags
2 Replies | Log In to Reply | Log In to Copy | Tell a Friend |
Trackback URL: http://www.kalivo.com/trackback/1556-re-removal-of-referral-validation
|
|
|
re: re: Removal of referral validation
a reply to re: Removal of referral validation in a conversation thread started here by Marc S. Schriftman on 2008-08-05 07:14 PM read 51 times |
Scott,
I'm on board with your first two points, but I'm not sure I understand point #3. Our tests detected that we changed the API, so we fixed out tests and now they pass, but platform units and functionals don't verify that client code (e.g. service_storage_client) has been adjusted correctly. Wouldn't we want integration tests in each client?
Marc
No current tags
1 Reply | Log In to Reply | Log In to Copy | Tell a Friend |
Trackback URL: http://www.kalivo.com/trackback/1557-re-re-removal-of-referral-validation
|
|
|
re: re: re: Removal of referral validation
a reply to re: re: Removal of referral validation in a conversation thread started here by Brittain on 2008-08-05 07:52 PM read 64 times |
My statement was that we wouldn't need an integration test. As you said (and I agree with) the functionals should've detected the breakage. Certainly an integration test suite (independent of the functionals/units) and an environment to execute it in is a good thing.
As for your point, shouldn't the service_storage_client have its own tests (particularly mocking the service)? As the distributors of this proxy, I'd expect that whomever updated the API would be responsible for updating any proxy for that API.
In practice this task is sometimes forgotten, but IMO that's a sign of a weak engineering effort (not knowing and covering ones dependencies).
No current tags
Log In to Reply | Log In to Copy | Tell a Friend |
Trackback URL: http://www.kalivo.com/trackback/1561-re-re-re-removal-of-referral-validation
