Add X-Blog-Check to the keep-list this document already describes - #84
Merged
Conversation
The access-log section said request headers are dropped except Referer and User-Agent. The host added X-Blog-Check to that allowlist when the header was introduced, which is the only reason request_X-Blog-Check appears at all, so the outward pass and the log description contradicted each other in the same file. The keep-list is named as the precondition rather than left as trivia. A header absent from it does not appear in the log, which reads exactly like a request that never sent one, and that is the negative-result trap this file now states as a rule. The reason the list is an allowlist is unchanged and still the point: it is what keeps the Pangolin resource access token out of a file that is retained and copied off the host. Found by Copilot review on #83. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR updates OPERATIONS.md to resolve an internal contradiction about which request headers Traefik retains in its access log, aligning the documented “keep-list” with the current outward-pass filter behavior that depends on X-Blog-Check.
Changes:
- Update the documented Traefik access-log header allowlist to include
X-Blog-CheckalongsideRefererandUser-Agent. - Clarify that the host-side keep-list is a prerequisite for the outward log-filter pass (absence in the log is indistinguishable from absence on the request).
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
"Request headers are dropped except" reads as Traefik stripping them from the request. That would mean the Pangolin access token never reaches the site, and the staging gate works, so a reader who took it that way would be left with two facts that cannot both hold. It now says the log records three and omits the rest from the record rather than from the request, which still arrives intact. Found by Copilot review on #84. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.
Suppressed comments (1)
OPERATIONS.md:302
- This paragraph names the header names (
Referer,User-Agent,X-Blog-Check), but elsewhere this document consistently refers to the Traefik access-log JSON field names (e.g.request_X-Blog-Check,request_Referer). Calling out the access-log keys here as well would avoid confusion about what exact fields appear in/var/log/traefik/access.log.
**On the VPS the reviewable record is Traefik's access log**, at `/var/log/traefik/access.log`, one JSON object per line, one line per request, across every hostname the host serves. `RequestPath` carries the query string, so the legacy `/?p=<id>` traffic is visible as itself. The log records only three request headers, `Referer`, `User-Agent`, and `X-Blog-Check`, and omits the rest from the record rather than stripping them from the request, which still arrives intact. That omission is what keeps the Pangolin resource access token out of a file that is retained and copied, and query strings are logged in full, so treat an extract as sensitive. That keep-list is the host's to hold and is the precondition the outward pass depends on: a header absent from it does not appear in the log at all, which is indistinguishable from a request that never sent one.
The sentence named the headers where the rest of the section names the JSON keys, so it described the policy without giving the thing anyone parsing the file actually needs. The three now appear as request_Referer, request_User-Agent and request_X-Blog-Check, which is the form already used in the jq examples above and below it. Found by Copilot review on #84, as a suppressed comment. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Owner
Author
|
Fixed. Right — I named the policy and not the thing anyone actually greps for. The rest of the section works in JSON keys, including the Now Worth noting the section already carries a trap about exactly this naming — |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Found by Copilot review on #83, the promotion. A contradiction inside
OPERATIONS.md, introduced by #81.The contradiction
The outward pass now filters on
X-Blog-Check, and the access-log section two hundred lines later said:Both cannot be true. The host added
X-Blog-Checkto Traefik's keep-list when the header was introduced — that is the only reasonrequest_X-Blog-Checkappears in the log at all — so the log description had simply gone stale and my new section was written against the current reality without reconciling the old one.The fix, and why it is more than adding a word
The keep-list now names all three, and is stated as the precondition the outward pass depends on rather than as trivia:
Which is the negative-result rule this file states as a trap, applied to the filter it was written beside. #81 recorded that the precondition exists; this names where it lives and what enforces it.
The reason the list is an allowlist is unchanged and still the point: it keeps the Pangolin resource access token out of a file that is retained and copied off the host. Adding a header to it is a host-side change and safe only for a value that is not secret, which the tag is not.