spinframework / spinframework/spin

Implement `CDN-Loop` (RFC 8586)

Open
#3,489 4 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Rust
Stars
6.5k
Forks
310
Avg merge
1d 20h
Merged PRs (30d)
24

Description

RFC 8586 protects systems from intra-CDN infinite loops.

The basic requirement here would be to copy any cdn-loop header from an incoming HTTP request onto any outbound HTTP request(s).

Given that it is somewhat natural to implement "CDN-like" features in Spin, I think this should be an opt-out runtime-configurable feature.

Open questions around whether/how to expose this header to guests:

  • Should it appear in inbound requests? I'd default to yes, but in some sense it may make the spin environment a little less portable.
  • Should guests be able to add values? Seems fine to allow, in which case any outbound cdn-loop header value(s) must be sent after copied inbound value(s).
  • If the answer to both of the above questions is "yes", we should probably be smart about only copying the header if the guest hasn't already (which it likely would if simply forwarding a request).

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with RFC 8586 and the issue's proposed behavior for incoming and outbound HTTP requests. Trace where Spin handles guest requests and creates outbound requests, then resolve the open questions about guest visibility, guest-added values, ordering, and opt-out runtime configuration. Done means the behavior and configuration are specified and implemented with coverage for copied and guest-supplied header values.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
api, backend
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.