[tinsch]

References

• Related to the discussion around performance optimizing our SSR Consider creating a trusted list of IPs for fine tuned SSR (to filter out aggressive bots) #6212

Description

This PR excludes community and collection search paths from SSR, much like the browse paths which are already excluded. Bots might hit these paths and add search facets, which basically leads to them becoming crawler traps. We already exclude these paths in our robots.txt but that does not seem to help.

I also simplified the patterns in the process, so we have a smaller number of them to maintain. I think this needs extra documentation, so our users with a customized config.yml benefit from the new pattern.

One thing to note:
Over here we discussed if this change might impact search results like these on search engines

may allow for searches like "Harvard Faculty of Arts and Sciences theses" to find the exact Collection where the theses of the FAS department at Harvard exist. This is a real search that will find you an exact collection in their DSpace: https://www.google.com/search?q=harvard+faculty+of+arts+and+sciences+theses

and we didn't come to a clear conclusion yet. I welcome thoughts on this.

Instructions for Reviewers

1. try out SSR on a community and a collection search page
2. notice that SSR is no longer being served on those paths
3. test that SSR is still excluded on community and collection browse paths

optional:
4. try out this setting on you repository and notice if it helps with bots hitting these paths less

AI Disclosure (REQUIRED)

Per our AI Contribution Policy, all contributors to DSpace MUST disclose AI/LLM usage.
This information helps reviewers assess provenance, licensing, security, and the level of verification needed.

If AI tools were ONLY used for incidental assistance (such as spelling/grammar correction, variable auto-completion, or translation), then select 'No'.

Were AI tools used in the creation of this PR?

• No (This PR does NOT include AI-generated or AI-assisted content that requires disclosure.)
• Yes (This PR includes AI-generated or AI-assisted content that requires disclosure.)

If "Yes", briefly describe what portion of this PR was generated or assisted by AI. Additionally, tell us how you've verified the AI output aligns with DSpace's coding standards and is secure and accurate.

(Example: "AI assisted me in investigating the bug and generated a suggested patch. I reviewed, modified and tested the code. No AI was used for the PR description.")

Checklist

This checklist provides a reminder of what we are going to look for when reviewing your PR. You do not need to complete this checklist prior creating your PR (draft PRs are always welcome).
However, reviewers may request that you complete any actions in this list if you have not done so. If you are unsure about an item in the checklist, don't hesitate to ask. We're here to help!

• My PR is created against the main branch of code (unless it is a backport or is fixing an issue specific to an older branch).
• My PR is small in size (e.g. less than 1,000 lines of code, not including comments & specs/tests), or I have provided reasons as to why that's not possible.
• My PR follows all coding best practices based on the Code Conventions Guide
• My PR passes ESLint validation using npm run lint
• My PR doesn't introduce circular dependencies (verified via npm run check-circ-deps)
• My PR includes TypeDoc comments for all new (or modified) public methods and classes. It also includes TypeDoc for large or complex private methods.
• My PR passes all specs/tests and includes new/updated specs or tests based on the Code Testing Guide.
• My PR aligns with Accessibility guidelines if it makes changes to the user interface.
• My PR uses i18n (internationalization) keys instead of hardcoded English text, to allow for translations.
• My PR includes details on how to test it. I've provided clear instructions to reviewers on how to successfully test this fix or feature.
• If my PR includes new libraries/dependencies (in package.json), I've made sure their licenses align with the DSpace BSD License based on the Licensing of Contributions documentation.
• If my PR includes new features or configurations, I've provided basic technical documentation in the PR itself.
• If my PR fixes an issue ticket, I've linked them together.

[tdonohue]

@tinsch : I gave this a quick look today, and I can verify that I believe this should be OK for search engine indexing for the following reasons:

• Our Sitemaps always have references to the main Community/Collection page via a URL like: http://localhost:4000/communities/[uuid]
• I've verified that the main URL still undergoes SSR. So, if you disable Javascript in your browser, that main URL will still load, e.g. http://localhost:4000/communities/[uuid]
• However, I've also verified that if you go to the /submit subpath, then SSR no longer works. So, this path won't trigger SSR: http://localhost:4000/communities/[uuid]/search.

Technically, in default DSpace, both the paths http://localhost:4000/communities/[uuid] and http://localhost:4000/communities/[uuid]/search have the exact same content. But, since search engines are directed to the former (via the Sitemaps), they should still be able to index the Communities/Collections.

One other minor note inline below. I think the new regex is slightly wrong.

[github-actions]

Hi @tinsch,
Conflicts have been detected against the base branch.
Please resolve these conflicts as soon as you can. Thanks!

[tinsch]

Hi @tinsch, Conflicts have been detected against the base branch. Please resolve these conflicts as soon as you can. Thanks!

Rebased the PR onto current main and solved the merge conflicts

[saschaszott]

@tinsch , I mentioned the idea in this comment . I had also identified another URL pattern there. Should that one be included as well?

[tinsch]

@saschaszott you mean the subcoms-cols subpath right? I never encountered that one, what does it do?

I focused on excluding community and collection search in this PR since it can function as a crawler trap when bots go through all the facets and pages on that path. I assume excluding that will have a big impact.

[tinsch]

FYI I changed the regex since it did not properly match query parameters before, which is necessary for the search part of the regex. I was also inspired by @alanorth 's comment on another ticket to remove the anchor. The regex now also matches URLs like /communities/<uuid>/search123 and /communities/<uuid>/browseXYZ. Note that the same is true for our search and browse regexes at the root level. If you want a stricter match, we could use this regex, which also matches query parameters:

/(communities|collections)/[a-fA-F0-9-]{36}/(browse|search)(/.*|\\?.*)?$

[saschaszott]

If you want a stricter match, we could use this regex, which also matches query parameters:

/(communities|collections)/[a-fA-F0-9-]{36}/(browse|search)(/.*|\\?.*)?$

@tinsch , excludePathPatterns is only matched against the URL path (req.path in ngApp() in server.ts), and req.path does not contain the query string (in Express). So any pattern meant to match query parameters can never match.

[alanorth]

Thanks @tinsch. I tested this and it works. I was surprised to see that we are not already excluding community/collection search from SSR, which in some cases can be millions of pages due to search facets.

I think the pattern proposed in this PR is good, that is:

       { pattern: '^/(communities|collections)/[a-fA-F0-9-]{36}/(browse|search)' },

Also, I just noticed we also have: enableSearchComponent and enableBrowseComponent, which apparently excludes those components in from the HTML of SSR responses already. We should think about the implications and interaction between both of these to see if they are complimentary or if we can simplify something.

[tinsch]

Also, I just noticed we also have: enableSearchComponent and enableBrowseComponent, which apparently excludes those components in from the HTML of SSR responses already. We should think about the implications and interaction between both of these to see if they are complimentary or if we can simplify something.

Ah yes, thanks for the reminder, I looked into it some time before. To me it seems like setting enableSearchComponent to false only disables parts of the search page, whereas enableBrowseComponent=false does disable loading the whole browse page. You can look at the code differences here for search and here for browse.

When you run DSpace with Javascript disabled you can also observe that behavior.

[alanorth]

Thanks @tinsch. These changes look good to me. +1

---

For the future, I'm wondering: if we have a default pattern that excludes the browse and search pages from SSR entirely, do we even need the logic around enableBrowseComponent and enableSearchComponent?

If a site wants to render browse and or search pages in SSR, they can adjust the default exclude patterns. I worry that DSpace configuration is becoming overly complex, with so many knobs to turn and switches to flip.

[saschaszott]

if we have a default pattern that excludes the browse and search pages from SSR entirely, do we even need the logic around enableBrowseComponent and enableSearchComponent

IMO, this is because collection pages, community pages and entity pages can contain search or browse components. You'll want to apply SSR to the page itself while excluding the search and browse components from SSR.

[alanorth]

IMO, this is because collection pages, community pages and entity pages can contain search or browse components. You'll want to apply SSR to the page itself while excluding the search and browse components from SSR.

@saschaszott ah yes you are right. I mixed up the browse/search paths and browse/search components embedded in community/collection pages.

This is at +2 so we can merge it. I will squash the commits so the history is clean, and I will attempt auto porting back to DSpace 8, 9, and 10.

[dspace-bot]

Backport failed for dspace-8_x, because it was unable to cherry-pick the commit(s).

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin dspace-8_x
git worktree add -d .worktree/backport-6344-to-dspace-8_x origin/dspace-8_x
cd .worktree/backport-6344-to-dspace-8_x
git switch --create backport-6344-to-dspace-8_x
git cherry-pick -x fa8e5cc10ffb0f7cbb6c3934c9390c5b86eaa11d

[dspace-bot]

Backport failed for dspace-9_x, because it was unable to cherry-pick the commit(s).

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin dspace-9_x
git worktree add -d .worktree/backport-6344-to-dspace-9_x origin/dspace-9_x
cd .worktree/backport-6344-to-dspace-9_x
git switch --create backport-6344-to-dspace-9_x
git cherry-pick -x fa8e5cc10ffb0f7cbb6c3934c9390c5b86eaa11d

[dspace-bot]

Successfully created backport PR for dspace-10_x:

• [Port dspace-10_x] exclude community and collection search from ssr #6470

[alanorth]

@tinsch thank you for this pull request. The automatic backports to DSpace 8 and 9 failed. If you have time it would be nice to have these backported manually since those branches are still supported and the changes should be straightforward.