apollo-ios icon indicating copy to clipboard operation
apollo-ios copied to clipboard

Please allow disabling undocumented HTTP headers that can't be turned off

Open andykent opened this issue 1 year ago • 3 comments

Use case

Apollo seems to add a whole bunch of headers to every network request.

  • X-APOLLO-OPERATION-NAME
  • X-APOLLO-OPERATION-TYPE
  • X-APOLLO-OPERATION-ID
  • apollographql-client-version
  • apollographql-client-name
  1. I count find these documented anywhere.
  2. We would like to turn them off (IMO they should be opt-in, in part for privacy reasons, in part for bandwidth and logs noise)
  3. It looks like they are hardcoded in HTTPRequest.init so there doesn't seem to be any real way to disable them.

Describe the solution you'd like

Ideally I think we would like to see RequestChainNetworkTransport take a includeDefaultHeaders: Bool or includeHeaders: OptionSet argument to configure this.

Also some docs around what is sent would be a good improvement.

andykent avatar Jul 07 '23 08:07 andykent

Thanks for the request @andykent. We're not opposed to adding an option to turn off default headers, but it's pretty low on our list of priorities right now. That said, it should be pretty simple to implement, so if you would like to make a PR, I'd be happy to look at it and help you get this merged in for the next release!

Though we would like it to be opt-OUT for the time being rather than opt-IN. If this features is implemented, we can reconsider making it opt-IN for the 2.0 release, but just to maintain backwards compatibility with the current behavior, we wouldn't want to make this disabled by default in a minor release.

AnthonyMDev avatar Jul 10 '23 20:07 AnthonyMDev

@andykent do you use any other Apollo software in your stack? There may be impacts to those that would require a configuration change, if you use them and these headers were omitted.

calvincestari avatar Jul 10 '23 22:07 calvincestari

Thanks both:

  • I will try to find some time to take a look at a PR.
  • Agreed on being opt-out for now so as not to break backwards compatability.
  • We do not use Apollo on the server. We use absinthe on the backend so all good there.

andykent avatar Jul 11 '23 08:07 andykent