Skip to content

fix(google_fastly_waf): Do not serve GET cached responses on OPTIONS requests - #504

Merged
leplatrem merged 1 commit into
mainfrom
cors-waf-fastly
Oct 15, 2026
Merged

leplatrem merged 1 commit into
mainfrom
cors-waf-fastly

Conversation

@leplatrem

@leplatrem leplatrem commented Oct 14, 2026 •

Copy link
Copy Markdown
Contributor

Description

Since we migrated to Fastly, we cannot navigate the Remote Settings public data from the Admin UI.
Because OPTIONS requests are served cached GET responses.

Screenshot 2026-10-14 at 13 49 26

This PR sends anything but GET/HEAD/FASTLYPURGE to the origins.

Who it affects in webservices-infra

  │       Service       │            Current snippet             │        Effect of the change        │
  ├─────────────────────┼────────────────────────────────────────┼────────────────────────────────────┤
  │ pontoon             │ already has the exact boilerplate      │ none                               │
  │                     │ check                                  │                                    │
  ├─────────────────────┼────────────────────────────────────────┼────────────────────────────────────┤
  │ balrog, monitor,    │ only set the cache header for GET/HEAD │ none                               │
  │ vpn                 │                                        │                                    │
  ├─────────────────────┼────────────────────────────────────────┼────────────────────────────────────┤
  │ fx-sharing          │ only geo-blocks POST /api/v1/create    │ none                               │
  ├─────────────────────┼────────────────────────────────────────┼────────────────────────────────────┤
  │ treeherder          │ sets the cache header for GET, HEAD    │ preflights go to the origin        │
  │ (/assets/*)         │ and OPTIONS                            │ instead of cache                   │
  ├─────────────────────┼────────────────────────────────────────┼────────────────────────────────────┤
  │ mdn                 │ sets the cache header for GET, HEAD    │ preflights go to the origin        │
  │                     │ and OPTIONS                            │ instead of cache                   │
  └─────────────────────┴────────────────────────────────────────┴────────────────────────────────────┘

Related Tickets & Documents

@leplatrem
leplatrem requested review from a team and Tibap as code owners October 14, 2026 11:50
@bkochendorfer bkochendorfer changed the title fix(google_fastly_waf) Do not serve GET cached responses on OPTIONS requests fix(google_fastly_waf): Do not serve GET cached responses on OPTIONS requests Oct 14, 2026
@bkochendorfer bkochendorfer added the minor This PR will increment a minor version label Oct 14, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Release plan

Directory Previous version New version
google_fastly_waf 2.30.0 2.31.0

@bkochendorfer bkochendorfer added major This PR will increment a major version minor This PR will increment a minor version and removed minor This PR will increment a minor version major This PR will increment a major version labels Oct 14, 2026

@bkochendorfer bkochendorfer left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great, thank you!

@leplatrem
leplatrem merged commit 78d0b25 into main Oct 15, 2026
18 of 26 checks passed
@leplatrem
leplatrem deleted the cors-waf-fastly branch October 15, 2026 08:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

minor This PR will increment a minor version

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants