Include X-HUB-TOKEN header along with X_HUB_TOKEN for better server support

[davidlaprade]

We currently send along the X_HUB_TOKEN as a header for requests to endpoints:

'X_HUB_TOKEN' => connection.token || '',

This makes sense, since the spree/endpoint_base uses X_HUB_TOKEN for authorization:

halt 401 if request.env["HTTP_X_HUB_TOKEN"] != @endpoint_key

Unfortunately, use of underscores in HTTP headers is a legacy feature, requiring explicit, non-default configurations on the most common ruby web servers: nginx and apache.

From the NGinx docs:

If you do not explicitly set underscores_in_headers on;, NGINX will silently drop HTTP headers with underscores (which are perfectly valid according to the HTTP standard). This is done in order to prevent ambiguities when mapping headers to CGI variables as both dashes and underscores are mapped to underscores during that process.

And the docs for recent versions of Apache:

Translation of headers to environment variables is more strict than before to mitigate some possible cross-site-scripting attacks via header injection. Headers containing invalid characters (including underscores) are now silently dropped.

Sending along both HTTP_X_HUB_TOKEN and HTTP-X-HUB-TOKEN should improve compatibility for a majority of users.

[davidlaprade]

@bricesanchez @AlessioRocco Friendly ping on this :)

Test failures don't seem to be related to this code. It's whatever is causing the failures on master.

[davidlaprade]

This actually seems to be the cause of the test failures (here and on master): https://github.com/nebulab/cangaroo/commit/c1f5b39c06eab0a19af88d4102bfa0a53527c713

Prior to this commit, all my tests pass via bundle exec appraisal rspec, after it, I start getting failures. It appears that using the non-positional #post method -- i.e. passing a hash with headers: {}, params: {} to the #post method -- wipes the headers of the headers["Content-Type"] == "application/json", substituting it with "application/x-www-form-urlencoded"

[davidlaprade]

Confirmed: this fixes the test failures: https://github.com/nebulab/cangaroo/pull/60

[davidlaprade]

@bricesanchez @AlessioRocco

Can I get an update on this? Is there anything this needs to get it merged in? Thanks!

[AlessioRocco]

@davidlaprade, merged, thanks!