3 ms·
The API version header has a few problems. 1. Older proxies used to remove/strip headers they don't understand. 2. Frameworks and libraries don't always give
by ChrisAtWork 10y ago
The API version header has a few problems.
1. Older proxies used to remove/strip headers they don't understand.
2. Frameworks and libraries don't always give access to n non-standard headers, meaning they just can't used.
3. It's harder for humans to look at a request and see what's going on.
- JimDabell 10y agoProxies stripping headers isn't a problem if you use HTTPS or HTTP 2. Additionally, the proper place for this is the Content-Type header, which is a standard header any proxy would understand. I can't say I've come across a framework or a library that makes it impossible to access a non-standard header, and if there are any, that would be a pretty glaring bug. Nevertheless, the proper place for this information is in the Content-Type header, which is a standard header. In what way is it hard for a human to look at a request to see what's going on? The information is right there.
- ChrisAtWork 10y agoWhy do you think HTTPS would fix this? For the TLS case, there are enough MITM proxies, both in the Enterprise and elsewhere, to make this a real concern. There are also API Aggrigators which are effectively MITM and need to be taught to "play-well" with custom headers. Certainly in the consumer case HTTPS would keep a majority of consumer facing ISPs from header-stripping, but there is still a pretty big hole.