search

overte-org / overte

Overte open source virtual worlds platform.
https://overte.org/
Other
138 stars 50 forks source link

Proxy HTTP requests through domain server #241

Open akamicah opened 1 year ago

akamicah commented 1 year ago

(To investigate and propose solution)

HTTP requests from both in-world scripts, and from interface (for assets) if direct from end-user to URL would leak IP addresses of end-users so it would be a nice feature to proxy these requests via the domain server the player is logged on to protect their IP address.

A request from client should be accompanied by a session token to ensure only logged-in users can proxy requests to prevent abuse, and this will also open the door to enable asset caching at the domain server to aid delivery

JulianGro commented 1 year ago

I really don't think this is a good idea. For one, we would need to proxy a lot more than just assets to prevent IP addresses from “leaking”. We would also need to do the same for the web engine. As a server owner, I don't think I would be alone in saying that I wouldn't allow me server to do this. I don't have the bandwidth to function as a proxy for people, but I also wouldn't do it even if I had the bandwidth. The people I am functioning as a proxy for might do god knows what with over my network connection. I wouldn't want the police to knock on my door because someone did something uncanny using my server as a proxy. As a user, I would also not want to make use of that function, as it would just slow everything down in most scenarios. There is also the question if hiding peoples IP addresses really makes much sense at all. I mean there is still at least three servers that would know their IP address.

I think the biggest issue here is that you leave your IP address everywhere on the Internet anyway. If you really needed or wanted to hide your IP address, you would already have to use a VPN or similar anyway.

akamicah commented 1 year ago

I need to look at the web side a bit more, but would suggest not having to proxy web content providing the users have the control to enable the content or not. The liability is a tricky problem as I do believe the user should be afforded protection before the service provider - and any illicit content that appears in world, we as a domain provider would need to be able to blacklist it anyway which would be a lot easier if we had the ability to blacklist urls etc. I shall look a bit more into web elements