Production Verification · api.phantom.app · share

Every curl we ran against prod, and what each one proves

Read-path behavior, error handling, and the full auth boundary of the share service in production — run directly against the public gateway right after rollout. Writes require a real user JWT minted by auth, so the write path is proven by its rejections: no credentials, spoofed identity headers, and forged tokens all bounce at the mesh before touching the service.

7/7
checks behave as designed
3
auth-bypass attempts blocked
~0.2s
warm response time
=
staging/prod parity
404 GET share record — unknown id 2.705s
REQUEST
curl https://api.phantom.app/share/AAAAAAAAAA
RESPONSE — HTTP 404 · content-type: application/json; charset=utf-8 · cache-control: public, max-age=3600, immutable
{"message":"Share not found","error":"Not Found","statusCode":404}

404 with the service's JSON body — proves pod + CRDB + routing

404 GET share card image — unknown id 0.207s
REQUEST
curl https://api.phantom.app/share/AAAAAAAAAA/image
RESPONSE — HTTP 404 · content-type: application/json; charset=utf-8 · cache-control: public, max-age=3600, immutable
{"message":"Share not found","error":"Not Found","statusCode":404}

404 JSON from the image route — renderer path wired

400 GET share record — malformed id 0.251s
REQUEST
curl https://api.phantom.app/share/../../etc/passwd --path-as-is
RESPONSE — HTTP 400 · content-type: text/html
<html>
<head><title>400 Bad Request</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
<hr><center>cloudflare</center>
</body>
</html>

400 rejected at the edge — path traversal never reaches the service

403 POST /share — no credentials 0.175s
REQUEST
curl -X POST https://api.phantom.app/share -H 'content-type: application/json' -d {"payload":{"kind":"profile","username":"ghosty"},"deepLinkPath":"profile/ghosty"}
RESPONSE — HTTP 403 · content-type: text/plain
RBAC: access denied

403 RBAC: Istio AuthorizationPolicy requires JWT for writes

403 POST /share — spoofed x-forwarded-user header 0.165s
REQUEST
curl -X POST https://api.phantom.app/share -H 'content-type: application/json' -H 'x-forwarded-user: 550e8400-e29b-41d4-a716-446655440000' -d {"payload":{"kind":"profile","username":"ghosty"},"deepLinkPath":"profile/ghosty"}
RESPONSE — HTTP 403 · content-type: text/plain
RBAC: access denied

403 RBAC: client-supplied identity headers are not honored from outside — spoofing blocked at the mesh

401 POST /share — bogus JWT 0.2s
REQUEST
curl -X POST https://api.phantom.app/share -H 'content-type: application/json' -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.e30.invalid' -d {"payload":{"kind":"profile","username":"ghosty"},"deepLinkPath":"profile/ghosty"}
RESPONSE — HTTP 401 · content-type: text/plain
Jwt issuer is not configured

401: RequestAuthentication rejects tokens from unknown issuers

404 GET /share/:id — staging comparison 0.279s
REQUEST
curl https://staging-api.phantom.app/share/AAAAAAAAAA
RESPONSE — HTTP 404 · content-type: application/json; charset=utf-8 · cache-control: public, max-age=3600, immutable
{"message":"Share not found","error":"Not Found","statusCode":404}

staging behaves identically to prod