Fixed incorrect behavior of :BlockedApiPolicy #9742

[cesarpferreira]

What this PR does / why we need it:
Documentation from our findings when solving an issue related to incorrect behavior of the policy to block API access.

Which issue(s) this PR closes:

Closes #9742

Special notes for your reviewer:

Suggestions on how to test this:

Does this PR introduce a user interface change? If mockups are available, please link/include them here:
No.

Is there a release notes update needed for this change?:
No.

Additional documentation:

[pdurbin]

https://dataverse-guide--9747.org.readthedocs.build/en/9747/installation/config.html#blocking-api-endpoints looks good to me! Approved.

Here's a screenshot:

[donsizemore]

is this specific to nginx? if so, should we make a note of that?

[pdurbin]

@cesarpferreira thanks for the pull request! Please note the question above by @donsizemore. Thanks!

[cesarpferreira]

is this specific to nginx? if so, should we make a note of that?

@donsizemore that is a good question. We were doing some tests with haproxy in one installation, but it had the host IP address so it was working correctly. I can try to change it to localhost and check if this happens

[cesarpferreira]

is this specific to nginx? if so, should we make a note of that?

@donsizemore that is a good question. We were doing some tests with haproxy in one installation, but it had the host IP address so it was working correctly. I can try to change it to localhost and check if this happens

Just confirmed, it also happens with haproxy and this situation is most common when you only have one server behind the reverse proxy service and it is easier to set up the backend as localhost.

[pdurbin]

Does that mean we're ok with the pull request as-is? Or should @cesarpferreira add an additional note? (@cesarpferreira please feel free to add more if you like!)

[pdurbin]

We just talked about this at standup. @donsizemore and I are happy with it as-is so I'm moving it to QA.