Re: cross origin problem for fonts and other static assets on php.net

On Thu, Jul 10, 2014 at 8:22 AM, Ferenc Kovacs <tyra3l@gmail.com> wrote: > > > > On Thu, Jul 10, 2014 at 4:58 PM, Hannes Magnusson > <hannes.magnusson@gmail.com> wrote: >> >> On Thu, Jul 10, 2014 at 5:09 AM, Ferenc Kovacs <tyra3l@gmail.com> wrote: >> > when we introduced the round robin mirror domains (us.php.net for >> > example) >> > that caused that some mirrors were incorrectly flagged as unofficial, if >> > $_SERVER['SERVER_NAME'] contained cc.php.net instead of ccX.php.net >> > (because >> > that is how we store and identify our mirrors). >> >> One more thing to keep in mind, we may be introducing geodns with >> roundrobin for php.net too very soon. >> That means all mirrors need to update their ServerNames/aliases. > > > Yeah, it was mentioned before, but I'm not 100% sure about the implications. > php.net will resolve to the addresses to the (nearest) country based on the > visitor's ip. > Which means that mirrors will have to add the php.net and www.php.net > aliases to the list of ServerAliases and also do the www.php.net->php.net > redirect themselves. > Will we keep the invidual mirror subdomains(ccx.php.net), and the option for > the users to select a prefered mirror? > I think we should. Yes. [www.]php.net will resolve to CC.php.net which in turn will round-robin to CCX.php.net. You'll still be able to overwrite this by selecting you preferred mirror, or visiting CCX.php.net directly. > Will we keep the cc.php.net subdomains? Yes > Currently we also have a loadcheck in the source, which redirects to a > random mirror if the average load on the mirror is above a given threshold, > and that redirect is only allowed on the primary site: > > http://git.php.net/?p=web/php.git;a=blob;f=include/loadavg.inc;h=6fa0dce3ec5bd682a5a1e7a86c2bcbe69e47e518;hb=HEAD#l16 > I think that we should revisit that if we are going to allow the mirrors to > be the "primary" sites. Its fine to keep it and make it more generic? Not > Another thing is the account request page, which currently we always > redirect to the www.php.net domain: > > http://git.php.net/?p=web/php.git;a=blob;f=git-php.php;h=9a73afa9901470596ab7a620a2f1b86b9df26569;hb=HEAD#l7 > It is already a bad thing that we post the password through an insecure > channel, but now we start allowing the mirrors to accept those passwords > themselves (a rouge mirror could have done that already, but now everyone > would do it). > What do you think about these concerns? The form itself should be on master.php.net. -Hannes