Upstream: https://we.phorge.it/T15859
Check if we use dns-prefetch / preconnect for phab.wmfusercontent.org defined in https://phabricator.wikimedia.org/config/edit/security.alternate-file-domain/ : https://developer.mozilla.org/en-US/docs/Web/Performance/dns-prefetch
No grep results for both strings in upstream Phorge/Arcanist code.
cf old and potentially related or obsolete comment: T670#11554
Would be trivial four lines in Phabricator code but would love to hear from Traffic folks if this makes sense in our setup? (Feel free to remove the tag again!)
security.alternate-file-domain is set to https://phab.wmfusercontent.org in our WMF setup.
diff --git a/src/aphront/response/AphrontResponse.php b/src/aphront/response/AphrontResponse.php index 355177e316..82130dcc0e 100644 --- a/src/aphront/response/AphrontResponse.php +++ b/src/aphront/response/AphrontResponse.php @@ -110,6 +110,13 @@ abstract class AphrontResponse extends Phobject { $headers[] = array('Referrer-Policy', 'no-referrer'); + $cdn = PhabricatorEnv::getEnvConfig('security.alternate-file-domain'); + if ($cdn) { + $headers[] = array('Link', '<' . $cdn . '>; rel="preconnect"'); + } + foreach ($this->headers as $header) { $headers[] = $header; }
Test Plan:
we already leverage preconnect on some cases but not as an HTTP Header but using the HTML <link> tag:
$ curl -v -s https://en.wikipedia.org/wiki/Main_Page 2>&1 |grep -i preconnect <link rel="preconnect" href="//upload.wikimedia.org">
From the top of my head I don't think the CDN would filter out a Link header set by a backend server though.
@Aklapper we've briefly discussed this yesterday during the Traffic weekly meeting and you can proceed and enable preconnect
Thanks a lot! I'm going to wait on upstream conversations in https://we.phorge.it/T15859 what's the most suited place in the code base.
Thanks. Waiting on getting this merged into upstream first not to increase our downstream diff