Usage of X-SHA-256 and other cleanups in BUD-11#93
Open
pippellia-btc wants to merge 4 commits intohzrd149:update-auth-tokensfrom
Open
Usage of X-SHA-256 and other cleanups in BUD-11#93pippellia-btc wants to merge 4 commits intohzrd149:update-auth-tokensfrom
pippellia-btc wants to merge 4 commits intohzrd149:update-auth-tokensfrom
Conversation
/upload and /media.
optional in the bud-11 table
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hey @hzrd149, I found several issues in the current BUD-11, so instead of pointing them out I fixed them in a PR to the branch.
Readable version
TLDR;
BUD-11 had a section "Endpoint-specific requirements" which didn't match the requirements in the specific BUDs. So I've unified all logic in the BUD-11, and other buds just link to it, which IMO makes implementations easier to make.
Previously, the "x" tag of an auth token of an /upload needed to match the request sha256. This is problematic because servers need to A) buffer the blob and B) compute the hash just to validate auth.
We thought of using the
Content-Digestheader for this, however, that header has a specified encoding, which allows different hash functions. This freedom doesn't exists in blossom, so I preferred to use another header, which isX-SHA-256, already used in the HEAD /upload and HEAD /media.I fixed also several typos, clarified few concepts, defined the encoding of
X-SHA-256.I've kept the requirement of the "x" tag for most endpoints, with the exception of GET /sha and HEAD /sha (even though I disagree and I would make it optional everywhere).
Take your time and let me know what you think.