coreinfrastructure / best-practices-badge

🏆Open Source Security Foundation (OpenSSF) Best Practices Badge (formerly Core Infrastructure Initiative (CII) Best Practices Badge)
https://www.bestpractices.dev
MIT License
1.22k stars 202 forks source link

Can't edit silver, but can edit passing & gold #1983

Open rvagg opened 1 year ago

rvagg commented 1 year ago

When logged in, visiting https://bestpractices.coreinfrastructure.org/en/projects/29?criteria_level=1 and clicking on "Edit", which should take me to https://bestpractices.coreinfrastructure.org/en/projects/29/edit?criteria_level=1, I get redirected to https://bestpractices.coreinfrastructure.org/en. But this doesn't happen for criteria_level=0 and criteria_level=2.

(Ref: https://github.com/nodejs/security-wg/issues/953)

david-a-wheeler commented 1 year ago

That is.... weird. I'm not sure why that's happening. Thank you for the report.

david-a-wheeler commented 1 year ago

@andrewfader - any ideas?

david-a-wheeler commented 1 year ago

Can you try again? I'm not having any issues. I hate problems that are intermittent :-(.

rvagg commented 1 year ago

yes, sorry, I thought you fixed it because it started working again!

david-a-wheeler commented 1 year ago

I guess we'll leave this closed because I can't figure out how to duplicate the problem to track it down. Thanks for the report, we will keep looking to see if we can keep it from happening again.

rvagg commented 1 year ago

This issue is back again and the team is keen to update their Silver status.

These work, give me 200's and let me edit the pages:

This doesn't, and gives me a 302:

I've cleared cache, tried a completely different browser, it's persistent.

david-a-wheeler commented 1 year ago

Well, ugh. I'm very sorry you're having this problem (again). I got a different problem report that I suspect is caused by the same problem. So let me fix that, and hopefully your problem is "fixed for free" :-). But if that doesn't work, I'll need to track this one down too.

rvagg commented 1 year ago

I had a bit of success today when I thought I'd try varying the request: https://www.bestpractices.dev/en/projects/29/edit?criteria_level=1&boop gets me in and seems to have worked in letting me edit the form; so I guess this might be a caching problem somewhere in the stack that's holding on to the redirect and just busting the cache gets past the problem?

david-a-wheeler commented 7 months ago

I still can't reproduce the problem, sigh, which makes this hard to fix.

I think you're probably right, there must be a subtle caching problem. We've made a few tweaks to the cache invalidation that hopefully resolves this.