[
https://issues.apache.org/jira/browse/TINKERPOP-2480?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17637453#comment-17637453
]
ASF GitHub Bot commented on TINKERPOP-2480:
-------------------------------------------
cole-bq commented on code in PR #1838:
URL: https://github.com/apache/tinkerpop/pull/1838#discussion_r1029815951
##########
gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/channel/WebSocketChannelizer.java:
##########
@@ -108,7 +109,7 @@ public void configure(final ChannelPipeline pipeline) {
closeOnProtocolViolation(false).allowExtensions(true).maxFramePayloadLength(settings.maxContentLength).build();
pipeline.addLast(PIPELINE_REQUEST_HANDLER, new
WebSocketServerProtocolHandler(GREMLIN_ENDPOINT,
null, false, false, 10000L, wsDecoderConfig));
-
+ pipeline.addLast("ws-user-agent-handler", new WsUserAgentHandler());
Review Comment:
Unfortunately I'm not sure this reordering is possible without substantial
change. The user agent handler triggers on a HandShake.Complete event right as
the handshake is finishing. The authentication and authorization handlers take
effect after the handshake is finished. Since the user agent is sent as an http
header though, it is limited by MaxHeaderSize which defaults to 8192. This
should be sufficient protection against maliciously large headers being sent
from unauthenticated users. I will add a test which confirms this behavior.
> User agent for Gremlin drivers
> ------------------------------
>
> Key: TINKERPOP-2480
> URL: https://issues.apache.org/jira/browse/TINKERPOP-2480
> Project: TinkerPop
> Issue Type: Improvement
> Components: driver, server
> Affects Versions: 3.4.8
> Reporter: Divij Vaidya
> Priority: Minor
>
> Currently, a server does not distinguish amongst the different types of
> clients connecting to it. This issue is to add a new feature to add user
> agent field in the HTTP and WebSocket request header which could be used to
> identify the specific client from which the request was made.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
