https://citoid.wikimedia.org/ works great, but unfortunately so does http://citoid.wikimedia.org/ when really it should redirect.
Description
Status | Subtype | Assigned | Task | ||
---|---|---|---|---|---|
Resolved | • csteipp | T98096 Security review of Citoid | |||
Resolved | BBlack | T108632 http://citoid.wikimedia.org/ should force HTTPS |
Event Timeline
Hopefully we will be able to turn off parsoidcache soon(TM), which effectively means citoid.wikimedia.org would disappear. Instead, Citoid requests would be served by RESTBase (cf T108646: Set-up Citoid behind RESTBase).
@BBlack is there a (possibly-trivial) way to set the redirection up in parsoidcache? Given that we'd all like to get rid of it and try to work towards that, does it make sense to set it up at all?
@Jdforrester-WMF apart from Citoid's extension, are there any other known users of citoid.wikimedia.org?
@mobrovac: the code used to redirect the main sites can be enabled for parsoidcache with the flick of a virtual switch. We just didn't do it yet because of fears some consumers of the services hosted there (parsoid, citoid, cxserver, graphoid, restbase) not being compatible with the redirects, and there are other bigger fish to fry first :)
If you think we can flip the switch now, I'm all for it.
Oh. :-(
@Jdforrester-WMF apart from Citoid's extension, are there any other known users of citoid.wikimedia.org?
Quite a few gadgets and user scripts out there. This has been the public URL for months and we've encouraged developers to use it. Deprecating it is fine, but removing it all of a sudden would not be very cool.
So long as the mapping is trivial (e.g. https://citoid.wikimedia.org/foo/bar becomes https://en.wikipedia.org/api/v1/citoid/foo/bar), we can easily support the old URL mapping in the text cluster as well, without keeping parsoidcache itself alive.
I gather from this that if we flip the switch we have to do it for all of the services? If so, it'd be prudent not to force it just yet. If we can do it just for Citoid, we'd need to gather more info on the consumers. @Jdforrester-WMF - thoughts? Send an announcement to a magic VE or the wikitech list?
Yeah, that's why I was asking.
Hm. The change would involve transforming requests like:
curl 'http://citoid.wikimedia.org/api?search=blah&format=mediawiki'
into:
curl https://en.wikipedia.org/api/rest_v1/data/citation/mediawiki/blah
So, we'd need a rewrite that moves data from the query string into the URL. Pretty tricky. But, we might want to allow RESTBase to accept requests like https://en.wikipedia.org/api/rest_v1/data/citation?search=blah&format=mediawiki and then internally redirect it to https://en.wikipedia.org/api/rest_v1/data/citation/mediawiki/blah
When we moved various *oid to the text cluster as part of the parsoidcache decom, they got forced to HTTPS-only as a side-effect.