Advertise that content-served is IPLD/IPFS on gateway via HTTP

[nicola]

1. When I do a HTTP request, there is no way for me to understand whether the data has been served is an IPFS/IPLD object.
2. Currently, there is no way for a client to check that the content served is actually the correct one.

I do see the case for people to make light clients for the browser that only get data through a gateway, but still want to be able to check whether the data served match the hash (or the merkle proof path is valid). These clients however, should only do this check when they know that the content served is an IPLD/IPFS content.

How can we do this?

• HTTP gateway uses the Link header to specify that it is an IPLD object? (I see only the HTTP header as the right place for this)
• When the client (like a browser plugin) receives the content, then check that the page is an IPLD/IPFS object and finally does the check

---

cc @lgierth maybe?

Would an X-IPLD-Hash: <multihash> work? The hash would represent the entity body without transformation like transport-encoding or content-encoding applied. The same obviously also works for request bodies :)

I feel like this calls for a spec chapter "verifying IPLD object integrity in HTTP".

[nicola]

I feel like this calls for a spec chapter "verifying IPLD object integrity in HTTP".

This is where the question comes from :)
I actually was just thinking of generalize it to

• X-Multihash
• X-CID
• or simpler, X-Integrity: mutlihash or CID or CID+Path