Harden request logging and proxy trust - #92
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1a007f7de9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| # Default command - run with uvicorn | ||
| CMD ["python", "-m", "uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000", "--workers", "1"] | ||
| CMD ["python", "-m", "app.main"] |
There was a problem hiding this comment.
With the default Docker/Compose configuration, ENABLE_METRICS is true and this command first executes app.main as __main__; main() then asks Uvicorn to import app.main:app again in the same single-worker process. The second import re-registers the module-level Prometheus counters under the same names, causing ValueError: Duplicated timeseries in CollectorRegistry and preventing the OCR container from starting. Keep the direct Uvicorn entrypoint or otherwise ensure the application module is initialized only once.
Useful? React with 👍 / 👎.
| response = await call_next(request) | ||
| response.headers["X-Request-ID"] = request_id |
There was a problem hiding this comment.
When an endpoint raises an unhandled exception before producing a response, call_next() propagates out of this middleware and the header assignment is skipped; Starlette's outer server-error middleware then invokes the registered Exception handler and returns a 500 without X-Request-ID. Consequently, the failures for which correlation is most useful cannot be matched to the request ID written to the server log. Attach the ID in the global exception response as well, or ensure this middleware adds it on the exception path.
Useful? React with 👍 / 👎.
1 participant
Scope
X-Request-IDvalues and reject client correlation-ID spoofing, including early security responses.TRUSTED_PROXY_IPS/OCR_TRUSTED_PROXY_IPSallowlists.Validation
./mvnw -B test— 30 tests passed.python3 -m compileall -q app tests— passed.docker-compose configwith local validation variables — passed.git diff --check— passed.Related: #72