logoalt Hacker News

lucideerlast Saturday at 5:26 PM1 replyview on HN

If both are present but different the unprefixed version should be favoured. That seems uncontroversial & not complex to implement.

Sending two headers seems fine in most cases.

These are certainly downsides but hardly dealbreakers. On the other side, not prefixing has its own pros & cons, which seem more difficult to work around:

1. The obvious clash issue. If two pieces of software implement entirely different X-Value: headers, the standardisation effort clarifies the signal in the form of an unprefixed version. If both competing software applications start out unprefixed, the signal will always be ambiguous.

2. Implementation changes. If any lessons are learnt during initial use of a prefixed header, these can be applied by standardising on a slightly improved unprefixed version.


Replies

garblegarblelast Saturday at 6:11 PM

> If both are present but different the unprefixed version should be favoured. That seems uncontroversial & not complex to implement.

oops, you just enabled smuggling where there's a mismatch between what a proxy/firewall/etc supports and what an internal service supports.

    X-Do-Evil: true
    Do-Evil: false
show 1 reply