Implementation challenges: x-correlator

[StefanoFalsetto-CKHIOD]

The format of x-correlator header is not clearly defined in YAML. For security reasons, it is better to clearly define it.
In Camara API Design Guidelines there is an example using an UUID, but it is not clear Which version of UUID should be used.

What should we use? UUIDv3? UUIDv5?

[FabrizioMoggio]

I'm not sure about the issue. In my understanding the value for x-correlator is chosen by the API Consumer. For the API Producer it is a String.

From the Guidelines:
"When the API Consumer includes the "x-correlator" header in the request, the API provider must include it in the response with the same value that was used in the request."

[StefanoFalsetto-CKHIOD]

I agree with you, this value is chosen by the API Consumer.
But, from a security point of view, it is better for an API Producer to know the details of data it is receiving. For example: which is the maximum length of this string? Which is the set of characters allowed?
We could answer to this questions just telling: the x-correlator must be (i.e., the opposite of recommended) an UUID.
A nice to have information could be which version of UUID is recommended.

[FabrizioMoggio]

@bigludo7 what do you think about this solution?

[bigludo7]

Hello - This is a fair comment. For me we should not enforce a uuid format to let developer the freedom to use any identifier but I understood @StefanoFalsetto-CKHIOD point about security. What about only specifying a maximum lenght? (to avoid inserting malicious code).
In any case i think this topic must be raised in Commonalities.

[FabrizioMoggio]

I agree with @bigludo7, also considering that x-correlator is used in all the API, we should provide the Developer with an agreed solution in Commonalities. The Guidelines currently doesn't impose, just suggest, the use of UUID to the Developer. @StefanoFalsetto-CKHIOD would you like to open an issue in Commonalities on this topic?

[StefanoFalsetto-CKHIOD]

Thank you for feedback. I think just enforcing the length is not sufficient from the security point of view, we also need to add the allowed set of characters.

But that's not the right place to talk about it, I agree with you. I will open an issue in Commonalties and I will link it here to continue talking about it in the right group.

[StefanoFalsetto-CKHIOD]

I have just opened the issue here: camaraproject/Commonalities#352

[FabrizioMoggio]

The identified solution by Commonalities is: https://github.com/camaraproject/Commonalities/pull/373/changes
This solution was implemented in the CFS API for the Fall25 release.