CFD-229 : Deploy on ACC : a lot of RestFulFloodException

[zero2one]

I deployed yesterday the develop branch on the ACC environment.

There is something strange with Restful API module:

• If I login and I want to change my password > RestFulFloodException.
• If I edit a node and hit save > RestFulFloodException.
• If I want to change the Search API server settings > RestFulFloodException.
• If I want to see the group dashboard (eg. c4d developer group) > WOSD (White Screen Of Death), when I load another page I get an error about the WOSD: “RestFulFloodException”.

Could it be that Restful is doing to much, even when it is not needed at all? (I even got some Restful related errors during the migration).

This is the message I get:

RestfulFloodException: Rejected by ip flood control. inRestfulAuthenticationBasic->authenticate() 
(line 32 of/var/www/capacity4more-acc.dev.amplexor.com/capacity4more/capacity4more/modules/contrib/restful/plugins/authentication/RestfulAuthenticationBasic.class.php).

Is there a work around for this as it blocks the demo…

[amitaibu]

can you do a debug_backtrace() to see where it's coming from. Or send me a db dump so I can check locally.

[amitaibu]

[zero2one]

[zero2one]

See CFD-229

[amitaibu]

@zero2one I've looked into this, and it seems RESTful is supposed to work properly.

Can we have a quick session together like last time, to check the DEV server. I have a feeling the $_SERVER['PHP_AUTH_USER'] and $_SERVER['PHP_AUTH_PW'] are somehow populated.

[zero2one]

@amitaibu Sounds logical as the site is sitting behind a htaccess login…

The htaccess login is necessary to protect prying eyes and Search bots.

[amitaibu]

Indeed it's the .htaccess

So we should change the result plugins authentication type to be array('cookie') -- so it won't hit the basic auth

[amitaibu]

Actually I found a better solution - https://github.com/RESTful-Drupal/restful/pull/336

So on ACC we will need to drush vset restful_skip_basic_auth 1 and it won't use the basic auth.

[zero2one]

We should add this to:

• Or the profile installer.
• Or to the c4m_restfull install file.

[amitaibu]

I think it should be environment specific - as in the production site, you would potentiality want to allow basic auth

[amitaibu]

https://github.com/RESTful-Drupal/restful/pull/336 is now in.

[zero2one]

The drush command fixes the issue.