Add new 'NonGovukDomains' module with 'EXTERNAL_HOST_REDIRECT_ALLOW_LIST' constant #367
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Currently, we have to try to keep three different allowlists in sync: - https://github.com/alphagov/whitehall/blob/b3ce66d717e8a78a2f59a3fce36f271359ab09e1/app/validators/gov_uk_url_format_validator.rb#L3-L11 - https://github.com/alphagov/short-url-manager/blob/d11edaa002b7c37eb7b3e45c1c289d99443eceef/app/models/concerns/short_url_validations.rb#L4-L15 - https://github.com/alphagov/publishing-api/blob/c82ab015b0751803302e352fc19deb23630daa7d/app/validators/routes_and_redirects_validator.rb#L2-L11 If the lists fall out of sync, we risk being inconsistent in which domains we allow redirects to, and potentially a data integrity issue whereby a publishing app might think a redirect is fine, but it's ultimately rejected in Publishing API. This commit copies over the current iteration of allowed redirect domains (which have been double-checked with Policy and Strategy in https://gds.slack.com/archives/CADTL63QR/p1714556082803429). When this is released, we can then update the publishing apps to refer to this shared allowlist instead.
ChrisBAshton
force-pushed
the
consolidate-domains
branch
from
ebca8cb to
ef04cc2
Compare
|
The lists need to be kept separate - see https://govuk.zendesk.com/agent/tickets/5819962. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Currently, we have to try to keep three different allowlists in
sync:
If the lists fall out of sync, we risk being inconsistent in which
domains we allow redirects to, and potentially a data integrity
issue whereby a publishing app might think a redirect is fine,
but it's ultimately rejected in Publishing API.
This PR copies over the current iteration of allowed redirect
domains (which have been double-checked with Policy and Strategy
in https://gds.slack.com/archives/CADTL63QR/p1714556082803429).
When this is released, we can then update the publishing apps to
refer to this shared allowlist instead.