[Cosmo-dev] Servlet filters and the art of client compatibility

[Travis Vachon]

Hi folks

Bug 10678 documents a problem that makes it impossible for clients  
using Internet Explorer with strict (but by some accounts fairly  
common) security settings. Specifically, due to IE's inability to  
parse XML that declares the default XML namespace we are required to  
use an ActiveX object to parse a modified version of the XML we  
receive from the server. As a result, clients (like Andre) who have  
particularly tight ActiveX related security settings are treated to a  
nasty error message when they try to log into the Hub Web UI.

In the bug I propose 2 possible solutions:

a) Not support IE users who have disabled ActiveX controls
b) Tweak the server so that IE doesn't choke

Personally, I'm happy with either in the short term. a) seems less  
than desirable in the long run, but I think it is certainly something  
that can be debated.

Option b) is something we have tried to avoid in the past, but in at  
least one case have taken to solve an IE problem. In particular, we  
discovered earlier this summer that Content-Type headers like  
"application/atom+xml;type=entry", the for entry documents in Abdera,  
make IE crash such that we aren't able to recover the contents of the  
corresponding request. To fix this we now manually set the Content- 
Type header to "application/atom+xml" in our Atom code, which is a  
little gross.

Given these two bugs, I suspect we will run into similar problems in  
the future. In order to facilitate keeping our business logic clear  
of these hacks, I'd like to propose we handle this with a servlet  
filter that detects user agents and implements the appropriate quirk  
accommodation code. For now, this filter would implement the fixes  
for the IE quirks we've seen so far, stripping the default XML  
namespace from responses and rewriting "application/atom+xml;type=*"  
to "application/atom+xml". Over time we could add similar processing  
code to support other troublesome clients.

I imagine this would make sense to implement in the 0.8 timeframe.

Thoughts?

-Travis