Restrict CDot endpoint access to GitLab.com instances

Restrict CDot endpoint access to GitLab.com instances

Problem

Currently, CDot endpoints can be accessed from both GitLab.com and self-managed instances. This has led to issues where self-managed instances attempting to access CDot endpoints receive 401 unauthorized responses creating unnecessary load, as demonstrated in issue #573356 (closed).

Proposed Solution

Add access control to CDot endpoints by:

1. Implementing an allow_non_saas_requests parameter or similar in the Gitlab::SubscriptionPortal::Client class
2. Setting the parameter to false by default
3. Only enabling allow_non_saas_requests=true for specific pages that require CDot access from non-.com instances

Expected Behavior

• By default, CDot endpoints should only be accessible from GitLab.com instances
• Self-managed instances should be prevented from making unauthorized CDot requests
• Specific exceptions can be configured where necessary through the new parameter

Impact

This change will prevent unnecessary unauthorized requests from self-managed instances to CDot endpoints.

---

Description was generated using AI