## Summary Roll out [the JSON error response for rate-limited /oauth/register requests](https://gitlab.com/gitlab-org/gitlab/-/work_items/602891) currently behind the `oauth_dynamic_registration_json_rate_limit_error` feature flag, introduced in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/248395. - DRI: @habdul-razak - Team Slack channel: `#g_sscs_authentication` > [!note] > Process and guidance live in the docs — this issue is just the commands and a place to track the rollout. > "Rolling out" means incrementally enabling the flag on GitLab.com to validate stability — it is not the same as releasing the feature, which happens when the flag is removed. > [Feature flag controls](https://docs.gitlab.com/development/feature_flags/controls/) · [Feature flag lifecycle](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle) ## What could go wrong? - Only changes the response of an already rate-limited `POST /oauth/register`. - The plain-text body becomes a JSON OAuth error with a `Retry-After` header, per [RFC 6749 Section 5.2](https://datatracker.ietf.org/doc/html/rfc6749#section-5.2) and [RFC 7591 Section 3.2.2](https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.2). - Rollback is disabling the flag. ## Rollout Run all production `/chatops` in [`#production`](https://gitlab.slack.com/archives/C101F3796) and cross-post the results to `#g_sscs_authentication`. Background: [incremental rollout process](https://docs.gitlab.com/development/feature_flags/controls/#process), [feature actors](https://docs.gitlab.com/development/feature_flags/#feature-actors). Validate after each enable by POSTing to `/oauth/register` until throttled. The 429 must return a JSON body with a `Retry-After` header (response headers are not in rails logs, so curl is the check). **Non-production** - `/chatops gitlab run feature set oauth_dynamic_registration_json_rate_limit_error 50 --actors --dev --pre --staging --staging-ref` - `/chatops gitlab run feature set oauth_dynamic_registration_json_rate_limit_error true --dev --pre --staging --staging-ref` Validate on staging — loops until throttled, then prints the full 429 to check for the JSON error body and `Retry-After` header: ```shell while true; do response=$(curl -si -X POST "https://staging.gitlab.com/oauth/register" \ -H "Content-Type: application/json" \ -d '{"client_name":"ff-rollout-test","redirect_uris":["https://example.com/callback"]}') echo "$response" | head -n 1 echo "$response" | head -n 1 | grep -q 429 && { echo "$response"; break; } done ``` **Production** — percentage rollout (wait ≥15 min between steps, watch dashboards): - `/chatops gitlab run feature set oauth_dynamic_registration_json_rate_limit_error <percentage> --actors` Or target specific actors instead: - `/chatops gitlab run feature set --project=gitlab-org/gitlab,gitlab-org/gitlab-foss oauth_dynamic_registration_json_rate_limit_error true` - `/chatops gitlab run feature set --group=gitlab-org,gitlab-com oauth_dynamic_registration_json_rate_limit_error true` - `/chatops gitlab run feature set --user=habdul-razak oauth_dynamic_registration_json_rate_limit_error true` Validate — loops until throttled, then prints the full 429 to check for the JSON error body and `Retry-After` header: ```shell while true; do response=$(curl -si -X POST "https://gitlab.com/oauth/register" \ -H "Content-Type: application/json" \ -d '{"client_name":"ff-rollout-test","redirect_uris":["https://example.com/callback"]}') echo "$response" | head -n 1 echo "$response" | head -n 1 | grep -q 429 && { echo "$response"; break; } done ``` ## Before global rollout Confirm the relevant gotchas before going to 100% — see [enabling a feature for GitLab.com](https://docs.gitlab.com/development/feature_flags/controls/#enabling-a-feature-for-gitlabcom): - [Docs + version history](https://docs.gitlab.com/development/documentation/feature_flags/) updated - [Breaking changes](https://docs.gitlab.com/development/documentation/release_notes/#deprecations-removals-and-breaking-changes) announced, if any - [Change management issue](https://handbook.gitlab.com/handbook/engineering/infrastructure-platforms/change-management/#feature-flags-and-the-change-management-process) opened, if required - [External API consumers](https://docs.gitlab.com/development/feature_flags/#do-not-use-feature-flags-in-external-api-consumers) handled with a fail-open mechanism, if applicable ## Cleanup Tracked in [the cleanup issue (19.6)](https://gitlab.com/gitlab-org/gitlab/-/work_items/631784). Remove the flag once [deemed stable](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle) — see [cleaning up](https://docs.gitlab.com/development/feature_flags/controls/#cleaning-up). Remove the flag and its YAML definition from the codebase, then: - `/chatops gitlab run release check https://gitlab.com/gitlab-org/gitlab/-/merge_requests/248395 19.6` - `/chatops gitlab run feature delete oauth_dynamic_registration_json_rate_limit_error --dev --pre --staging --staging-ref --production` ## Rollback - `/chatops gitlab run feature set oauth_dynamic_registration_json_rate_limit_error false` (production) - `/chatops gitlab run feature set oauth_dynamic_registration_json_rate_limit_error false --dev --pre --staging --staging-ref` (non-production) - `/chatops gitlab run feature delete oauth_dynamic_registration_json_rate_limit_error --dev --pre --staging --staging-ref --production` (remove entirely)