Use URI for X-Powered-By value

[csarven]

[The following is not strictly a node-solid-server issue but I think it can go a long way in setting it as a practice that other Solid server implementations or variations can follow suite. Eventually, this 'feature' can bubble up to the solid-spec - given that it is a common practice (aka sufficiently "incubated")]

The X-Powered-By header value eg solid-server can be more specific/unique. After all, which Solid server or which version? So, Solid servers should announce a URI as a value instead which can potentially be self-descriptive when dereferenced ie. another agent can find out about its capabilities, what specs it implements, making use of vocabs like DOAP stuff. This is beyond content or time negotiation etc.

Edit: granted that the string "solid-server" can mean that it is an implementation of the Solid spec, but that may be under the assumption that the server conforms to the latest state of the spec. While the clients could make that assumption, they can be mislead given what the server actually performs. So, the reality is that, there are indeed different versions of the application, as well as its conformance to the specs. All of that information and more can be discoverable through the URI.

eg curl -I https://linkedresearch.org/ldn/tests/ uses X-Powered-By: https://github.com/csarven/mayktso but it can also point to something more granular and actually return RDF.

[gobengo]

https://github.com/solid/node-solid-server/blob/19d1bf0ff5a9a59bb59300b8fce3bfcd038d0ea7/lib/create-app.js#L164

It begs the question.... what should the URI be?
https://github.com/solid/node-solid-server ?

Would be really nice to have a trust or foundation to control things like node-solid-server.com
W3C may be sufficient but their IT is all a little opaque.

[jaxoncreed]

Sounds good pull request welcome

[Ryuno-Ki]

Hm, I'm wondering, whether this could eventually lead to security problems.
I mean, what about people not updating their server + known vulnerabilities?
You are inviting attackers this way …
On the other side, announcing that you are running solid-server could be helpful to learn about the distribution of this project …

[csarven]

@gobengo Right. I don't know what would be best without an entity making that commitment. Using a (sufficiently) persistent identifiers like w3id.org may be one way. In context of the Solid ecosystem, clients must not make decisions based on the string value but instead they should use the URI to FYN if they need to...

@Ryuno-Ki I generally agree, less information about the server would definitely slow down a class of attacks, however, the "security problems" would exist irrespective of the server announcing its kind and version. It doesn't take a whole lot to figure out which software is behind a server or to test for known vulnerabilities. FYI, this would not be the only place where the server is (directly or indirectly) announcing its capabilities. FWIW, the Apache server even by default exposes itself with the version number in the headers. So, I would defer to that (and community) as something reasonably vetted instead of hashing it out here.

[Ryuno-Ki]

As long as you aware of the potential issues, I'm fine.
Yeah, I am aware of Apache being too chatty in default configuration.