Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve HTTP Header Management for WAF Compatibility #100

Open
jpsphaxer opened this issue Feb 19, 2025 · 1 comment
Open

Improve HTTP Header Management for WAF Compatibility #100

jpsphaxer opened this issue Feb 19, 2025 · 1 comment

Comments

@jpsphaxer
Copy link

Description:

Currently, applications using the Hotwire Native Android package need to manually inject Accept headers through JavaScript to ensure proper content negotiation:
This is just an example - though we could use a bridge component.

webView.evaluateJavascript(
    """
    window.customHeaders = {
        'Accept': '*/*, text/html, application/json'
    }
    """,
    null,
)

This approach has several drawbacks:

  1. Headers should be managed at the HTTP client level, not through JavaScript injection
  2. Missing proper Accept headers can trigger WAF security rules and block requests
  3. The path configuration JSON file request particularly needs these headers
  4. It puts the burden on application developers to handle what should be framework-level concerns

I propose improving the HotwireHttpClient to handle these headers natively by:

  • Adding default header management
  • Implementing proper content type negotiation headers
  • Using OkHttp interceptors for consistent header application
  • Maintaining backward compatibility

This would improve security, reduce boilerplate, and better match how web browsers naturally behave.

I'm happy to submit a PR for this change. Before proceeding, I'd appreciate any context on:

  • Any existing header management discussions/attempts
  • Preferred approach for backward compatibility
  • Testing requirements for HTTP-related changes
  • iOS Parity (can open up a PR also)

Let me know if this aligns with the project's goals and if you'd like me to proceed with the PR.

@jpsphaxer
Copy link
Author

what are your thoughts? @jayohms, @joemasilotti

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

1 participant