The proxy does this validation in def zone_detail:
zone = json_or_none(proxy_to_backend("GET", "zones/%s" % requested_zone))
if zone and zone.get("account", None) != g.username:
raise ForbiddenHowever for zones with many RRsets, it's a lot of overhead, and the RRsets are not needed for validation of the zone owner. So I would suggest to only fetch the full zone for GET requests, but for all other requests rrsets=false is added as a query parameter:
if request.method == "GET":
zone = json_or_none(proxy_to_backend("GET", "zones/%s" % requested_zone))
else:
zone = json_or_none(proxy_to_backend("GET", "zones/%s?rrsets=false" % requested_zone))
if zone and zone.get("account", None) != g.username:
raise ForbiddenThe same applies for def zone_notify, but as here only PUT is used, I'd suggest to blindly set rrsets=false.
The proxy does this validation in
def zone_detail:However for zones with many RRsets, it's a lot of overhead, and the RRsets are not needed for validation of the zone owner. So I would suggest to only fetch the full zone for
GETrequests, but for all other requestsrrsets=falseis added as a query parameter:The same applies for
def zone_notify, but as here onlyPUTis used, I'd suggest to blindly setrrsets=false.