Expand description
decdn gateway: serve decdn: URIs (#2449) to a browser over loopback
HTTP.
Content. GET /<hash>[/<path>][?ns=<id>] serves
decdn:<hash>[/<path>][?ns=<id>]. A blob or a bundle entry streams its
verified bytes in order as they arrive; a whole bundle (/<hash>/) gets an
HTML index of its entries. A content request carries TOKEN_HEADER (the
gateway token) and HOST_HEADER (the host of the page it serves); the
browser extension adds both, so page scripts never see the token. The
gateway pays with the registered capability whose scope covers that host:
an exact host first, then *.<domain>, then *; between equal scopes, the
token holder’s own registration before a page’s, then the earlier
registration. A capability whose pull stops for funding before its first
byte is retired and the next covering one takes the request. HEAD gets
405, since answering it would cost a paid pull.
Capabilities. The gateway holds one delegate key per capability, in
memory only. GET /_delegate mints a fresh key and returns its address, so
no two callers see the same address and none can follow the user across
sites; a key no capability claims within PENDING_TTL is dropped. A
caller is a web page by its http(s) Origin, or the gateway token holder
from outside any page. The pages of one site (a registrable domain by the
Public Suffix List, so subdomains share it) hold at most a few keys,
pending or registered, within a bound shared by all pages; the token
holder mints outside both bounds.
PUT /_capability registers a dcap1: capability issued to a minted
address, with a scope. The capability’s owner signature must recover the
on-chain owner of its pool on the gateway’s deployment. A page registers
through CORS, and its scope must cover its own origin’s host, whether or
not the request also carries the token: example.com may register
example.com, *.example.com or *, never another host, and never a
wildcard over a public suffix such as *.com or *.github.io. The token
holder registers any scope. GET /_capability lists the registrations to
the token holder. A restart drops every key, and with it every capability
issued to one.
Boundaries. Only /_delegate and /_capability answer cross-origin;
content never does, so a page can neither read a response nor set the
token or host headers itself. The token lives in <data-dir>/token,
owner-only. The gateway listens on loopback only and checks Host against
DNS rebinding.
Pulls. Every pull runs the blob fetch of decdn get with its bytes
going to the HTTP response, on one long-lived worker thread: the endpoint,
the buyer-pool store and the connections to nodes are built once per
gateway run, and up to 16 pulls stream at once, so a response whose reader
stops holds only its own pull.
Constants§
- HOST_
HEADER - The request header naming the host of the page a content request serves.
- PENDING_
TTL - How long a minted delegate waits for a capability before it is dropped.
- TOKEN_
HEADER - The request header carrying the gateway token.
Functions§
- gateway
- Run the gateway until Ctrl-C.