ipfs/ipfs-companion

HTTP Gateway Validator

Open

#593 opened on Sep 21, 2018

View on GitHub
 (0 comments) (3 reactions) (0 assignees)JavaScript (364 forks)batch import
exp/experthelp wantedkind/enhancementstatus/readytopic/security

Repository metrics

Stars
 (1,992 stars)
PR merge metrics
 (Avg merge 53d 3h) (1 merged PR in 30d)

Description

AKA checksuming payload as it arrives from untrusted gateway and checking if it match expected CID

Context

See Verifiable HTTP Gateway Responses at https://github.com/ipfs/in-web-browsers/issues/128

Work

  • research if/how we could calculate checksum as data arrives
  • research how we resolve CID of resources under a path and get insight into DAG structure
    • A: additional lookup via local js-ipfs used only for that or fallback on http://ipfs.io/api/v0/
    • B: additional HTTP headers with required metadata
  • research and design UX for indicating the payload is verified
  • implement streaming validator that drops connection if payload does not match expected digest

Related Resources

  • Prior art from Cloudflare: https://github.com/cloudflare/ipfs-ext/
    • it also has DNSSEC validator, but that should be a separate topic
    • limitation: only SHA-256 is supported in CIDs
  • If browser is able to verify CID digest, it will be possible to define public, untrusted gateway as the backend without need for trusting it returns valid data
  • Reproducible File Imports | https://github.com/ipfs/unixfs-v2/issues/15

Contributor guide

Research direction
Investigate how to implement streaming checksum validation using Firefox's webRequest.filterResponseData() API and determine the mechanism to resolve CIDs of resources under a path. Also design UX for verification indication.
Tech stack
javascript
Domain
backend
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Mostly clear
Prerequisites
JavaScriptIPFSbrowser extension dev
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
65