Cloud: Caching, CDN and Checkout

// CloudFront Function, runtime cloudfront-js-2.0, event type viewer-request.
// It decides, per request, whether a cached copy may be used, and writes the decision into the
// x-pc-edge header, which is part of the cache key of the default behaviour.
// "anon"            : an anonymous, cookie-less GET that may share a cache entry with every other visitor.
// "pass-<requestId>": a value that is unique per request, so the request can never hit another visitor's entry.
var STORE_COOKIE_PREFIXES = [
  'wp_woocommerce_session_',
  'wordpress_logged_in_',
  'wordpress_sec_',
  'wp-postpass_',
  'comment_author_'
];
var STORE_COOKIES = ['woocommerce_items_in_cart', 'woocommerce_cart_hash'];
var DYNAMIC_QUERY = ['add-to-cart', 'wc-ajax', 'wc-api', 'removed_item', 'undo_item', 'preview', 's'];

function hasStoreCookie(cookies) {
  var names = Object.keys(cookies);
  for (var i = 0; i < names.length; i++) {
    if (STORE_COOKIES.indexOf(names[i]) !== -1) {
      return true;
    }
    for (var j = 0; j < STORE_COOKIE_PREFIXES.length; j++) {
      if (names[i].indexOf(STORE_COOKIE_PREFIXES[j]) === 0) {
        return true;
      }
    }
  }
  return false;
}

function hasDynamicQuery(querystring) {
  for (var i = 0; i < DYNAMIC_QUERY.length; i++) {
    if (querystring[DYNAMIC_QUERY[i]] !== undefined) {
      return true;
    }
  }
  return false;
}

// Marketing parameters never change the page, so they must not split the cache.
function stripTracking(querystring) {
  Object.keys(querystring).forEach(function (name) {
    if (name.indexOf('utm_') === 0 || name === 'gclid' || name === 'fbclid') {
      delete querystring[name];
    }
  });
}

function handler(event) {
  var request = event.request;
  var bypass = (request.method !== 'GET' && request.method !== 'HEAD')
    || hasStoreCookie(request.cookies)
    || hasDynamicQuery(request.querystring);

  if (!bypass) {
    stripTracking(request.querystring);
  }

  // Always overwrite: a client must not be able to choose its own cache key.
  request.headers['x-pc-edge'] = { value: bypass ? 'pass-' + event.context.requestId : 'anon' };
  return request;
}

terraform {
  required_version = ">= 1.8"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

# CloudFront certificates and CLOUDFRONT-scoped web ACLs live in us-east-1.
provider "aws" {
  region = "us-east-1"
}

variable "alb_domain_name" {
  description = "DNS name of the ALB that the Ingress of the pocketcoffee release created (origin.pocketcoffee.example points at it)."
  type        = string
  default     = "origin.pocketcoffee.example"
}

variable "certificate_arn" {
  description = "ACM certificate in us-east-1 for www.pocketcoffee.example."
  type        = string
}

variable "origin_verify_value" {
  description = "Value of the X-Origin-Verify header that CloudFront adds and the ALB rule requires. Read it from Secrets Manager, never from this file."
  type        = string
  sensitive   = true
}

variable "admin_cidrs" {
  description = "Networks allowed to reach wp-admin and wp-login.php (documentation range as a placeholder)."
  type        = list(string)
  default     = ["203.0.113.0/24"]
}

locals {
  # Managed policies, by the IDs that the CloudFront documentation lists.
  caching_disabled_policy_id = "4135ea2d-6df8-44a3-9df3-4b5a84be39ad"
  all_viewer_policy_id       = "216adef6-5c7f-47e4-b989-5492eafa07d3"
  host_header_only_policy_id = "bf0718e1-ba1e-49d1-88b1-f726733018ae"

  # Paths that are never cached. The shop pages use the slugs set in WooCommerce > Settings > Advanced;
  # the Spanish storefront has its own slugs under /es/.
  dynamic_paths = [
    "/cart", "/cart/*",
    "/checkout", "/checkout/*",
    "/my-account", "/my-account/*",
    "/es/carrito", "/es/carrito/*",
    "/es/finalizar-compra", "/es/finalizar-compra/*",
    "/es/mi-cuenta", "/es/mi-cuenta/*",
    "/wc-api/*",
    "/wp-json/*",
    "/wp-admin/*",
    "/wp-login.php",
    "/wp-cron.php",
    "/xmlrpc.php",
  ]
}

resource "aws_cloudfront_function" "edge_router" {
  name    = "pocketcoffee-edge-router"
  runtime = "cloudfront-js-2.0"
  comment = "Writes the cache decision into x-pc-edge."
  publish = true
  code    = file("${path.module}/edge-router.js")
}

# Static files: versioned by the ?ver= query string that WordPress adds.
resource "aws_cloudfront_cache_policy" "static_files" {
  name        = "pocketcoffee-static-files"
  min_ttl     = 1
  default_ttl = 86400
  max_ttl     = 31536000

  parameters_in_cache_key_and_forwarded_to_origin {
    enable_accept_encoding_gzip   = true
    enable_accept_encoding_brotli = true

    cookies_config {
      cookie_behavior = "none"
    }
    headers_config {
      header_behavior = "none"
    }
    query_strings_config {
      query_string_behavior = "whitelist"
      query_strings {
        items = ["ver"]
      }
    }
  }
}

# Anonymous pages: a short life, keyed on the decision header and the query string, never on cookies.
resource "aws_cloudfront_cache_policy" "anonymous_pages" {
  name        = "pocketcoffee-anonymous-pages"
  min_ttl     = 0
  default_ttl = 60
  max_ttl     = 300

  parameters_in_cache_key_and_forwarded_to_origin {
    enable_accept_encoding_gzip   = true
    enable_accept_encoding_brotli = true

    cookies_config {
      cookie_behavior = "none"
    }
    headers_config {
      header_behavior = "whitelist"
      headers {
        items = ["x-pc-edge"]
      }
    }
    query_strings_config {
      query_string_behavior = "all"
    }
  }
}

# What the origin receives for a cacheable page: the Host header and the query string, and no cookies.
resource "aws_cloudfront_origin_request_policy" "page_origin" {
  name = "pocketcoffee-page-origin"

  cookies_config {
    cookie_behavior = "none"
  }
  headers_config {
    header_behavior = "whitelist"
    headers {
      items = ["Host"]
    }
  }
  query_strings_config {
    query_string_behavior = "all"
  }
}

resource "aws_cloudfront_distribution" "shop" {
  enabled         = true
  is_ipv6_enabled = true
  comment         = "pocketcoffee www"
  aliases         = ["www.pocketcoffee.example"]
  web_acl_id      = aws_wafv2_web_acl.shop.arn
  http_version    = "http2and3"

  origin {
    origin_id   = "alb"
    domain_name = var.alb_domain_name

    custom_origin_config {
      http_port                = 80
      https_port               = 443
      origin_protocol_policy   = "https-only"
      origin_ssl_protocols     = ["TLSv1.2"]
      origin_read_timeout      = 30
      origin_keepalive_timeout = 5
    }

    custom_header {
      name  = "X-Origin-Verify"
      value = var.origin_verify_value
    }
  }

  # Order matters: the first matching path pattern wins.
  dynamic "ordered_cache_behavior" {
    for_each = local.dynamic_paths

    content {
      path_pattern             = ordered_cache_behavior.value
      target_origin_id         = "alb"
      viewer_protocol_policy   = "redirect-to-https"
      allowed_methods          = ["GET", "HEAD", "OPTIONS", "PUT", "POST", "PATCH", "DELETE"]
      cached_methods           = ["GET", "HEAD"]
      compress                 = true
      cache_policy_id          = local.caching_disabled_policy_id
      origin_request_policy_id = local.all_viewer_policy_id
    }
  }

  ordered_cache_behavior {
    path_pattern           = "/wp-content/*"
    target_origin_id       = "alb"
    viewer_protocol_policy = "redirect-to-https"
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]
    compress               = true
    cache_policy_id        = aws_cloudfront_cache_policy.static_files.id

    # The Ingress routes on the Host header, so the static paths forward it too.
    origin_request_policy_id = local.host_header_only_policy_id
  }

  ordered_cache_behavior {
    path_pattern           = "/wp-includes/*"
    target_origin_id       = "alb"
    viewer_protocol_policy = "redirect-to-https"
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]
    compress               = true
    cache_policy_id        = aws_cloudfront_cache_policy.static_files.id

    # The Ingress routes on the Host header, so the static paths forward it too.
    origin_request_policy_id = local.host_header_only_policy_id
  }

  default_cache_behavior {
    target_origin_id         = "alb"
    viewer_protocol_policy   = "redirect-to-https"
    allowed_methods          = ["GET", "HEAD", "OPTIONS", "PUT", "POST", "PATCH", "DELETE"]
    cached_methods           = ["GET", "HEAD"]
    compress                 = true
    cache_policy_id          = aws_cloudfront_cache_policy.anonymous_pages.id
    origin_request_policy_id = aws_cloudfront_origin_request_policy.page_origin.id

    function_association {
      event_type   = "viewer-request"
      function_arn = aws_cloudfront_function.edge_router.arn
    }
  }

  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }

  viewer_certificate {
    acm_certificate_arn      = var.certificate_arn
    ssl_support_method       = "sni-only"
    minimum_protocol_version = "TLSv1.2_2021"
  }
}

resource "aws_wafv2_ip_set" "admin" {
  name               = "pocketcoffee-admin-networks"
  scope              = "CLOUDFRONT"
  ip_address_version = "IPV4"
  addresses          = var.admin_cidrs
}

resource "aws_wafv2_web_acl" "shop" {
  name  = "pocketcoffee-cloudfront"
  scope = "CLOUDFRONT"

  default_action {
    allow {}
  }

  # wp-admin and wp-login.php only from the office and VPN networks; admin-ajax.php stays open
  # because storefront plugins call it.
  rule {
    name     = "admin-allow-list"
    priority = 10

    action {
      block {}
    }

    statement {
      and_statement {
        statement {
          or_statement {
            statement {
              byte_match_statement {
                search_string         = "/wp-admin/"
                positional_constraint = "STARTS_WITH"
                field_to_match {
                  uri_path {}
                }
                text_transformation {
                  priority = 0
                  type     = "NONE"
                }
              }
            }
            statement {
              byte_match_statement {
                search_string         = "/wp-login.php"
                positional_constraint = "EXACTLY"
                field_to_match {
                  uri_path {}
                }
                text_transformation {
                  priority = 0
                  type     = "NONE"
                }
              }
            }
          }
        }
        statement {
          not_statement {
            statement {
              ip_set_reference_statement {
                arn = aws_wafv2_ip_set.admin.arn
              }
            }
          }
        }
        statement {
          not_statement {
            statement {
              byte_match_statement {
                search_string         = "/wp-admin/admin-ajax.php"
                positional_constraint = "EXACTLY"
                field_to_match {
                  uri_path {}
                }
                text_transformation {
                  priority = 0
                  type     = "NONE"
                }
              }
            }
          }
        }
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "admin-allow-list"
      sampled_requests_enabled   = true
    }
  }

  # Checkout submissions: at most 100 per five minutes from one address.
  rule {
    name     = "checkout-rate-limit"
    priority = 20

    action {
      block {}
    }

    statement {
      rate_based_statement {
        limit              = 100
        aggregate_key_type = "IP"

        scope_down_statement {
          byte_match_statement {
            search_string         = "/wp-json/wc/store/v1/checkout"
            positional_constraint = "STARTS_WITH"
            field_to_match {
              uri_path {}
            }
            text_transformation {
              priority = 0
              type     = "NONE"
            }
          }
        }
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "checkout-rate-limit"
      sampled_requests_enabled   = true
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "pocketcoffee-cloudfront"
    sampled_requests_enabled   = true
  }
}

# Trusted proxies: the pod network and the VPC (the ALB), plus the CloudFront edge addresses that
# the ALB sees as its peer and appends to X-Forwarded-For.
set_real_ip_from 10.0.0.0/8;
include /etc/nginx/cloudfront-ranges.conf;

# The ALB appends the address it received the connection from, so the client is the
# right-most entry that is not a trusted proxy.
real_ip_header X-Forwarded-For;
real_ip_recursive on;

location ~ \.php$ {
    include fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

    # The real client address, as resolved above, replaces anything the client sent in these
    # headers: WooCommerce reads X-Real-IP first, then the first X-Forwarded-For entry.
    fastcgi_param HTTP_X_REAL_IP $remote_addr;
    fastcgi_param HTTP_X_FORWARDED_FOR $remote_addr;
    fastcgi_param HTTP_CLIENT_IP $remote_addr;

    fastcgi_read_timeout 60s;
    fastcgi_pass 127.0.0.1:9000;
}

#!/usr/bin/env bash
# Writes the CloudFront address ranges as nginx set_real_ip_from lines.
# Run at image build time (and refresh the image regularly): the ranges change.
set -euo pipefail

out="${1:-/etc/nginx/cloudfront-ranges.conf}"
tmp="$(mktemp)"
trap 'rm -f "$tmp"' EXIT

curl -fsS --retry 3 https://ip-ranges.amazonaws.com/ip-ranges.json \
  | jq -r '.prefixes[] | select(.service == "CLOUDFRONT") | .ip_prefix | "set_real_ip_from " + . + ";"' \
  | sort -u > "$tmp"

if [ "$(wc -l < "$tmp")" -lt 10 ]; then
  echo "refusing to write a list with fewer than 10 ranges" >&2
  exit 1
fi
install -m 0644 "$tmp" "$out"

#!/usr/bin/env bash
# Checks what CloudFront does with a store. Run it from a laptop against the real domain.
set -euo pipefail

host="${1:-www.pocketcoffee.example}"

show() {
  # Print the status line and the headers that matter for caching.
  curl -sS -o /dev/null -D - "$@" \
    | grep -iE '^(HTTP/|x-cache|age|cache-control|set-cookie)' || true
  echo
}

echo "1. Home page twice: the second answer should say Hit from cloudfront and have an Age."
show "https://${host}/"
show "https://${host}/"

echo "2. Cart, checkout and my-account: never a hit, and Cache-Control says private."
for path in /cart/ /checkout/ /my-account/; do
  echo "${path}"
  show "https://${host}${path}"
done

echo "3. A request that carries the cart cookie must not be answered from the cache."
show -H 'Cookie: woocommerce_items_in_cart=1; woocommerce_cart_hash=0' "https://${host}/"

echo "4. A forged decision header must change nothing: the function overwrites it."
show -H 'x-pc-edge: anon' -H 'Cookie: woocommerce_items_in_cart=1' "https://${host}/"

echo "5. The Store API: no-store, and the Nonce and Cart-Token headers reach the browser."
curl -sS -o /dev/null -D - "https://${host}/wp-json/wc/store/v1/cart" \
  | grep -iE '^(HTTP/|x-cache|cache-control|nonce|cart-token)' | sed -E 's/(cart-token: .{12}).*/\1.../I'