[Opensim-dev] [Proposal] Expanded Grid Info Availability

[Haravikk]

> On 2 Aug 2017, at 00:28, David Saunders <abitar.com at gmail.com> wrote:
> 
> I was looking at some ideas from
> http://opensimulator.org/wiki/Category:OSSL_Functions , but the problem is
> how are you going to know the correct verification URL, if the regions
> tells you what it is?   Only way if you start with a verified URL.  The
> script it self can find out what grid its on. So you really need to know
> the grid has set up this check for you to have any kind of confidence in
> having the script tell where it is :)  You can send the info needed by the
> script.

This is actually the subject of my other topic on IP/region verification, I keep forgetting that I separated it into two topics thinking that simplified things 😏
Basically, imagine a script sends you the following:

	X-OpenSim-Location: x-grid-info://example.org:9000/My%20Region/1/2/3
	X-OpenSim-Region-Address: haravikk.com:9001

What your web-service could then do is send a request like:

	http://example.org:9000/verify_region?region=My%20Region&address=haravikk.com%3A9001

If the grid returns a positive response then I know that not only does the grid exist, but it has confirmed that a region by the given name is hosted by a machine at the given address, thus I know that the request came from a legitimate source (or at least, that the grid is willing to tell me so). Basically the idea is that grids would gain a /get_grid_info style service, but for verifying regions.

I created a wiki article on region verification here: http://opensimulator.org/wiki/User:Haravikk_Mistral/RegionVerification
And there's a separate topic on the mailing list under Verifying IP and Region.

I thought I'd keep the issues separate as the main thing I wanted to discuss here is whether people agree that making grid info more widely available is a good idea, or if there are real potential security/privacy issues. If that part is okay then the idea is to build upon it.