[Opensim-dev] Opensim-dev Digest, Vol 60, Issue 8

[Haravikk]

> On 15 Nov 2019, at 05:50, Kevin Cozens <kevin at ve3syb.ca> wrote:
> 
> On 2019-11-13 11:22 p.m., Dahlia Trimble wrote:
>> Personally I'm a fan of sending as little information as possible and only
>> what's necessary to accomplish a goal. If this patch is accepted by core I
>> would leave this feature disabled on my grid.
> 
> There are some interesting ideas for new headers but I think it would be a bit excessive if all of those settings were sent to a remote machine every time an HTTP request was made. It would be nice to be able to choose which ones to enable but that also would lead to compatibility issues from grid to grid not to mention all the extra settings to maintain.

I wonder actually, what if instead of having the headers configured at the simulator level and sent with all requests, we had a list of potential headers that a simulator can send, which scripts could then request, so if they know a web-service needs to know grid info, they'd request that those headers be added to the request.

Meanwhile all X-OpenSim-* header(s) that are added by the script itself will be removed, to prevent spoofing at the script level (prevents scripts from sending fake OpenSim headers through your simulator).

This still doesn't establish fully the trustworthiness of the sender, we'll need other features to do that, but it would eliminate the overhead of potentially sending a lot of headers with every request, by simply making all the extra headers a list of optional headers that scripts can individually request if they want them.