Possibility to upload OpenAPI definiton from URL

[eshepelyuk]

Hello,
As far as I could see - currently it's only possible to upload OpenAPI definition via file.
It could be great addition to be able to provide URL, so registry could download definition on it's own.

[EricWittmann]

I think this is a reasonable thing to do. It shouldn't be particularly difficult to implement. The risk of course is that the feature might not work at all in some deployment configurations (where the server cannot access external URLs). But I think that's just a documentation issue really.

@Apicurio/developers Thoughts?

[jsenko]

I agree. The only issue I can think of is a security one, e.g. if the URL is malicious and points to an extremely large file that could cause memory depletion. Unlikely, but the download has to be done carefully.

[carlesarnal]

+1. I agree with Jakub, the only issue that I see right now is security.

[eshepelyuk]

Well, I could propose following workaround to reduce risks

1. Registry issues HTTP HEAD request to the target URL.
2. According to HTTP specification, target server must return Content-Length header.
3. Registry analyzes value of Content-Length to check if file with declared size could be processed securely.
4. Finally, registry issues HTTP GET to the target URL and fetches only amount of bytes specified by HTTP HEAD from step 1.

WDYT ?

PS: the proposal implies that target URLs must support HTTP HEAD method.

[jsenko]

I've created an issue for this #1499
Thanks @eshepelyuk