Compatibility with fast404

Created on 13 February 2025, 6 months ago

Problem/Motivation

PerimeterSubscriber isn't triggered for me on fast404 requests.

The comment in \Drupal\perimeter\EventSubscriber\PerimeterSubscriber::getSubscribedEvents() claims it does, but \Drupal\Core\EventSubscriber\Fast404ExceptionHtmlSubscriber sets a priority of 200, and if an event is set, then the event propagation is stopped and the response is returned early.

Steps to reproduce

Proposed resolution

Set the weight to 300, to be before fast404.

Remaining tasks

User interface changes

API changes

Data model changes

πŸ› Bug report
Status

Active

Version

3.0

Component

Code

Created by

πŸ‡¨πŸ‡­Switzerland berdir Switzerland

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

  • Issue created by @berdir
  • πŸ‡¨πŸ‡­Switzerland berdir Switzerland

    Ah, the comment talks about the fast404 *module*. But Drupal has a built-in fast404 mechanism. I think that has been improved/fixed somewhat recently, so maybe that's the difference?

  • Merge request !31fast404 test and priority β†’ (Open) created by berdir
  • πŸ‡¨πŸ‡­Switzerland berdir Switzerland
  • Pipeline finished with Failed
    6 months ago
    Total: 175s
    #423275
  • Pipeline finished with Success
    6 months ago
    Total: 316s
    #423279
  • Status changed to Needs review about 2 months ago
  • πŸ‡ΊπŸ‡ΈUnited States bburg Washington D.C.

    I just came across this doing some testing on my own, discovering that Perimeter doesn't actually work when using fast404. While I like the idea of banning IPs that are probing my site for vulnerabilities, I suppose it's nice that they are still getting the treatment that minimizes demand on my infrastructure.

    I did come checking, and I confirm that the core module's BanMiddleware::handle(), which seems to do the checking for banned IPs, does also run before the fast 404 event subscriber, so there should be some added optimization making these modules compatible.

    I tested the patch in the merge request locally, and can confirm that the order changed to run Perimeter's event subscriber before Fast 404's.

    Is that good enough for RTBC?

Production build 0.71.5 2024