GithubHelp home page GithubHelp logo

Comments (6)

johanandren avatar johanandren commented on June 12, 2024 1

Thanks for the detailed write up, sounds like it would be safest to always quote the URIs

from akka-http.

johanandren avatar johanandren commented on June 12, 2024

Triggering with colon or always quoting would lead to quoting rel="acl, <http://localhost:8080/ldes/defaultCF/.acl>" from your sample which is probably not what you'd want, and always parsing to figure out if it is an URI or not sees expensive, hmmm.

from akka-http.

johanandren avatar johanandren commented on June 12, 2024

Or actually, maybe that is according to RFC 7230 because the value is not a valid token.

from akka-http.

bblfish avatar bblfish commented on June 12, 2024

Yes, so according to Postel's Law

Be conservative in what you do, be liberal in what you accept from others.

You should produce the headers that are most widely understandable, and that would be that Uri's be quoted, but when parsing Link headers you should allow the more liberal older version (which http4s does not but should).

This would allow me to create a Url for access control

Link: </.acl> rel="https://www.w3.org/ns/auth/acl#accessControl"

and this could be interpreted as saying that the resource which created the representation in which the Link header appeared has a relation named "https://www.w3.org/ns/auth/acl#accessControl" to the resource at the local relative url /.acl.

from akka-http.

johanandren avatar johanandren commented on June 12, 2024

Ok, let me rephrase that, I have something like a question hiding in there:

In your issue over at http4s, the full header is Link: <http://localhost:8080/ldes/defaultCF/stream.acl>; rel=acl, <http://localhost:8080/ldes/defaultCF/.acl>; rel=https://www.w3.org/ns/auth/acl#accessControl but I don't understand how you achieved that, unless you stuffed acl, <http://localhost:8080/ldes/defaultCF/.acl> into one LinkParams.rel(...).

That would mean that defaulting to quote the whole rel would end up with ...; rel="acl, <http://localhost:8080/ldes/defaultCF/.acl>"; which seems a bit strange to me.

from akka-http.

bblfish avatar bblfish commented on June 12, 2024

The code that Produces the ACL Link Values is line 106 of BasicContainer

 def aclLinks(acl: Uri, active: ACInfo): List[LinkValue] =
     LinkValue(acl, LinkParams.rel("acl")) :: {
       if acl == active.acl then Nil
       else LinkValue(active.acl, LinkParams.rel(BasicContainer.effectiveACLink)) :: Nil
     }

which is used for example, on line 662

        case OPTIONS =>
            pcmd.respondWith(HttpResponse( // todo, add more
              NoContent,
              `Accept-Post` :: Link(
                LDPLinkHeaders ::: aclLinks(uri, effectiveAcl)
              ) :: AllowHeader :: Nil
            ))
            Behaviors.same

But the problem is not the multiple links in one header. The problem comes from writing the URL in Akka. I duplicated the problem in http4s in this test which had to be ignored:

    val ht1 = """<>; rel=https://www.w3.org/ns/auth/acl#accessControl"""
    val ht1res: ParseResult[Link] = Link.parse(ht1)
    assert(ht1res.isRight, ht1res)

The above fails (I corrected the isLeft to isRight), but not if the quotes are places around the URL.

The problem is that I can't force the quotes to be there in Akka, and this will happen a lot more often as libraries are written for the latest Link RFC. So it's better to produce the stricter code, and accept the less strict one (eg. the above) in your incoming Link parser.

from akka-http.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.