Skip to content

Search streaming API should not be exposed under two separate routes, should not be exposed under UI router

Created by: slimsag

This search shows me that the search streaming API is registered in three places:

  1. sourcegraph.com/search/stream under app/ui/router.go (this does not make sense)
  2. sourcegraph.com/.api/search/stream under httpapi/router/router.go (this is good)
  3. The internal HTTP API under httpapi/router/router.go (this is good)

We should:

  1. Ensure no clients are using /search/stream, update them to use /.api/search/stream instead.
  2. Remove this route entry entirely: https://sourcegraph.com/github.com/sourcegraph/sourcegraph@276bd3513b286c29d127fbd11ede8735e5c3ab00/-/blob/cmd/frontend/internal/app/ui/router.go?L137

Why:

  1. It's confusing, and these routes will have different behavior: because /search/stream is a UI route, all cross-origin requests to it will be denied outright - whereas the /.api/search/stream one is an API route which allows it to be used from other domains, used with access tokens, etc.
  2. It's weird to expose an API under the UI router - it doesn't match our security model and could confuse others when trying to reason about the security model (but there is no imminent danger here)