http_header_envs option to include http headers as an env var

[danlester]

Similar to the QUERY_STRING environment variable that is set on a new kernel instance, this PR adds an HTTP_HEADERS env var which contains specified HTTP headers in a json-encoded dict.

There is a new configuration option, e.g. pass on the command line:

--VoilaConfiguration.http_header_envs="['X-CDSDASHBOARDS-JH-USER','user-agent']"

and then any new Voilà kernel will have an env var called HTTP_HEADERS containing a JSON-encoded dict which includes any of the specified headers that were available. For example:

{'X-CDSDASHBOARDS-JH-USER': '{"kind": "user", "name": "dan", "admin": true}', 'user-agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit...'}

The user-agent string could be used to provide alternative implementations or a warning message for an unsupported browser; the X-CDSDASHBOARDS-JH-USER value can be details of an authenticated user from ContainDS Dashboards (in which case, Voilà should only be accessible via the appropriate JupyterHub proxies, and not directly).

This system augments some really useful existing features or discussions such as #414 and #410.

[nariyar]

Dear @danlester
Is this merge expected to happen anytime soon? This would be a huge help. Will unblock progress of our work as we needed exactly this. Thanks in advance..

[maartenbreddels]

I'll take a look soon, I like the idea. Does this follow any standard, like CGI? (from mobile phone)

…

On Sat, May 22, 2021, 14:41 nariyar ***@***.***> wrote: Dear @danlester <https://github.com/danlester> Is this merge expected to happen anytime soon? This would be a huge help. Will unblock progress of our work as we needed exactly this. Thanks in advance.. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#835 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AANPEPOOWDWRDZYHQLDKSLDTO6Q53ANCNFSM4X4IW2VQ> .

[danlester]

@nariyar Thank you for your comment. I'm not a Voilà maintainer so can't merge it myself.

Marten would have to do it (which is why he said he'd take a look).

@maartenbreddels Thanks for taking a look - I'm not aware of any standard that is relevant here to be honest. I guess if you want it to be "similar to HTTP" in some sense, you might want the headers passed on in "Key: Value\n" form (with a blank line at the end...) instead of JSON, but maybe that's a bit weird for env vars really.

I think the most important thing is ease of use on the Voilà (notebook) side - we shouldn't expose Voilà authors to standards just because we think they are "right" from a technical level.

Maybe the easiest thing for the notebook author would be to access headers as individual env vars, e.g. X_HEADER_USER_AGENT and X_HEADER_ANYTHING_ELSE, as long as we can be consistent over naming. That would save the Voilà notebook having to JSON-decode.

[mariobuikhuizen]

I've looked into the available standards for this (on request of @maartenbreddels) and found that CGI has specifications for HTTP headers: https://datatracker.ietf.org/doc/html/rfc3875#section-4.1.18. As previous changes (#414) to supply server information to the kernel also conformed to the CGI standard, it would make sense to continue applying those standards here too.

Note that HTTP header names are case-insensitive: https://datatracker.ietf.org/doc/html/rfc2616#section-4.2, so the comparison in handler.py should also be done in a case-insensitive way.

Would you have the time and inclination to make these changes @danlester?

[danlester]

@mariobuikhuizen Hi there! In theory I would like to help, and will in due course. But not sure when I'll get on to it, so if it is important to anyone else they should please feel free to make a note here that they are working on it :)

[mariobuikhuizen]

Thank you @danlester, I will start working on it.

[jtpio]

Fixed by #922