Web SAMP and HTTPS: What to do?

TL;DR

This paper discusses the limitations of using SAMP for web applications over HTTPS and explores potential solutions including new profiles and helper applications.

Contribution

It introduces possible approaches to enable SAMP communication over HTTPS, including developing a new profile or using helper applications, with prototypes demonstrating feasibility.

Findings

Existing SAMP Web Profile does not support HTTPS.

Prototypes for new HTTPS-capable profiles have been developed.

Using helper applications can facilitate SAMP over HTTPS.

Abstract

SAMP, the Simple Application Messaging Protocol, is a standard developed within the Virtual Observatory to allow communication between different software items on the desktop. One popular usage scenario has been enabling one-click transmission of a table or FITS image from a web page, typically an archive search result of some kind, to a desktop application such as TOPCAT, Aladin or ds9. This has worked well for HTTP web pages since the introduction of the SAMP Web Profile in SAMP 1.3, but the Web Profile will not work over HTTPS, which is increasingly being adopted by data providers. This paper presents a summary of the problem and explores some possible ways forward, for which working prototypes have been developed: specify a new HTTPS-capable Profile, use a SAMP-capable helper application, or abandon using SAMP over HTTPS.