AutoPurge Causes Rest Request To Fail

[null93]

As [REDACTED] from [REDACTED] has experienced, his 3rd party integration triggers a product save event that Magento publishes. Since this module subscribes to product save before, it runs after the aforementioned event. That being said, since the 3rd party integration is authorized via token for Magento's REST api, then it does not have a user agent nor does it have a user object attached to the session manager. The exact failure is in the Helper/Data class where information about the caller is extracted and put into logs. Calling methods on a null user object causes the failed request.

[null93]

Replicate Behavior

We do not know which extension was used, all we know is that it is integrated via REST api. An assumption was made that the 3rd party integration triggers a product_save event. To replicate this bug, it seemed all that had to be done is the following:

1. Install Magento version
2. Install Varnish extension
3. Setup Varnish extension (enable, specify Varnish servers, enable auto-purger)
4. Create product from Catalog > Products with sku tester
5. Get token from REST api, using admin login information:

curl https://example.com/rest/V1/integration/admin/token \
    -kL \
    -X POST \
    -H "Content-Type: application/json" \
    --data '{"username":"admin","password":"password123"}'

6. Update product via REST api, so auto purger was triggered

curl https://example.com/rest/V1/products/tester \
    -kL \
    -X PUT \
    -H "Authorization: Bearer 1hz752gpbs5s23q0p47ctdjpzej0tqiv" \
    -H "Content-Type: application/json" \
    --data '{"product":{"name":"tester2"}}'

[null93]

Solution

The trivial solution that [REDACTED] supplied involved checking if the user object existed in the session. If it didn't a default value was used for id, username, and email. This solution will still be used as a fall back in case something happens and we do not want the request to fully fail.

All the code snippets below are taken from src/app/code/JetRails/Varnish/Helper/Data.php

return ( object ) [
	"interface" => "backend",
	"id" => $user ? $user->getId () : "n/a",
	"username" => $user ? $user->getUserName () : "n/a",
	"email" => $user ? $user->getEmail () : "n/a",
	"ip" => $remoteAddress->getRemoteAddress (),
	"browser" => $clientBrowser->browser,
	"system" => $clientBrowser->os
];

Since the HTTP_USER_AGENT is not set when api request is made, we check for it first so we do not get an "index is not found" error. This is found in the _getClientBrowser method:

$agent = isset ( $_SERVER ["HTTP_USER_AGENT"] ) ? $_SERVER ["HTTP_USER_AGENT"] : "";

Finally we detect if a REST api request is made by the caller by checking if the Authorization header exists in the request packet. While this is not the best solution, it is the only one that I could find. The only information that can be logged is the ip. Changes can be found in the getLoggedInUserInfo method:

// Check to see if request is being made via token authorization (with rest api)
else if ( $this->_http->getHeader ("Authorization") ) {
	return ( object ) [
		"interface" => "api",
		"ip" => $remoteAddress->getRemoteAddress ()
	];
}

[null93]

Testing

Testing needs to be done before a release can be rolled out. Test the following latest minor release versions:

• Magento 2.3 (php-7.2)
• Magento 2.2 (php-7.1)
• Magento 2.1 (php-7.1)