If a given server doesn’t have a SRV record instructing where to look, I take it it just queries that domain directly. If so, putting the API at /plan/ is problematic, because in situations where user content is hosted from a domain it can allow any user to control the appearance of the domain by hosting certain stuff under /plan/, and also various domains will already be using /plan/ for something else.
The solution for this is well-known URIs <https://www.rfc-editor.org/rfc/rfc8615.html>: put it under /.well-known/, where all such hosting providers should know not to allow users to place files.
So perhaps /.well-known/plan/ or /.well-known/dotplan/. And if you’re serious about this project, once you’ve got the basics ironed out and specified in detail, and probably some degree of interest from others, request registration in the register <https://github.com/protocol-registries/well-known-uris>.
Currently if there's no SRV record and the server that was actually queried doesn't have the user's plan, it will simply return 404/no plan. But this idea seems pretty neat, I will definitely be thinking about whether it makes sense and how to incorporate this.
3 comments
[ 3.1 ms ] story [ 19.8 ms ] threadThe solution for this is well-known URIs <https://www.rfc-editor.org/rfc/rfc8615.html>: put it under /.well-known/, where all such hosting providers should know not to allow users to place files.
So perhaps /.well-known/plan/ or /.well-known/dotplan/. And if you’re serious about this project, once you’ve got the basics ironed out and specified in detail, and probably some degree of interest from others, request registration in the register <https://github.com/protocol-registries/well-known-uris>.