Allow providing arbitrary HTTP headers for a uri style destination

[ctron]

Problem

Using a uri as a destination (e.g. in a Sequence) the receiving endpoint might be secured and require additional information to allow access.

One way to achieve this may be a custom header, which currently cannot be presented as only a URI can be provided.

I guess the same is true when using a ref instead of a uri.

Persona:

Event consumer

Exit Criteria

Configure a Sequence with arbitrary additional HTTP headers, check that the receiving endpoint receives these.

Time Estimate (optional):

1

Additional context (optional)

[slinkydeveloper]

Interesting, this might require to modify the Destination duck type... @vaikas @n3wscott @lionelvillard @grantr any thoughts?

[vaikas]

I'd be down to define this more. When we were working on defining the Destination we did talk about some other things that we might want to bake in there, and one of the use cases was tokens. I not convinced however that we want to expand Destination to include a token (visible to anybody that can see the resources), but maybe a ref to a secret or something, but would be good to define couple of use cases for this and then figure out the best way to implement.

[lberk]

@ctron could you elaborate a bit more on the use-case so we can ensure any security requirements are properly met while integrating this into our apis?

[ctron]

My concrete use case is Eclipse Ditto in "pre-authenticated" mode: https://www.eclipse.org/ditto/installation-operating.html#pre-authentication

That requires to set a custom header x-ditto-pre-authenticated, which proves that this user is special. All other ways into the system are expected to filter out this header.

I am pretty sure there are other use cases, providing standard or non-standard headers to influence the processing on the server side. Security related or not.

[github-actions]

This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Reopen the issue with /reopen. Mark the issue as
fresh by adding the comment /remove-lifecycle stale.