| draft-ietf-httpbis-p1-messaging-02.txt | draft-ietf-httpbis-p1-messaging-03.txt | |||
|---|---|---|---|---|
| Network Working Group R. Fielding, Ed. | Network Working Group R. Fielding, Ed. | |||
| Internet-Draft Day Software | Internet-Draft Day Software | |||
| Obsoletes: 2616 (if approved) J. Gettys | Obsoletes: 2616 (if approved) J. Gettys | |||
| Intended status: Standards Track One Laptop per Child | Intended status: Standards Track One Laptop per Child | |||
| Expires: August 27, 2008 J. Mogul | Expires: December 19, 2008 J. Mogul | |||
| HP | HP | |||
| H. Frystyk | H. Frystyk | |||
| Microsoft | Microsoft | |||
| L. Masinter | L. Masinter | |||
| Adobe Systems | Adobe Systems | |||
| P. Leach | P. Leach | |||
| Microsoft | Microsoft | |||
| T. Berners-Lee | T. Berners-Lee | |||
| W3C/MIT | W3C/MIT | |||
| Y. Lafon, Ed. | Y. Lafon, Ed. | |||
| W3C | W3C | |||
| J. Reschke, Ed. | J. Reschke, Ed. | |||
| greenbytes | greenbytes | |||
| February 24, 2008 | June 17, 2008 | |||
| HTTP/1.1, part 1: URIs, Connections, and Message Parsing | HTTP/1.1, part 1: URIs, Connections, and Message Parsing | |||
| draft-ietf-httpbis-p1-messaging-02 | draft-ietf-httpbis-p1-messaging-03 | |||
| Status of this Memo | Status of this Memo | |||
| By submitting this Internet-Draft, each author represents that any | By submitting this Internet-Draft, each author represents that any | |||
| applicable patent or other IPR claims of which he or she is aware | applicable patent or other IPR claims of which he or she is aware | |||
| have been or will be disclosed, and any of which he or she becomes | have been or will be disclosed, and any of which he or she becomes | |||
| aware will be disclosed, in accordance with Section 6 of BCP 79. | aware will be disclosed, in accordance with Section 6 of BCP 79. | |||
| Internet-Drafts are working documents of the Internet Engineering | Internet-Drafts are working documents of the Internet Engineering | |||
| Task Force (IETF), its areas, and its working groups. Note that | Task Force (IETF), its areas, and its working groups. Note that | |||
| skipping to change at page 1, line 49 | skipping to change at page 1, line 49 | |||
| and may be updated, replaced, or obsoleted by other documents at any | and may be updated, replaced, or obsoleted by other documents at any | |||
| time. It is inappropriate to use Internet-Drafts as reference | time. It is inappropriate to use Internet-Drafts as reference | |||
| material or to cite them other than as "work in progress." | material or to cite them other than as "work in progress." | |||
| The list of current Internet-Drafts can be accessed at | The list of current Internet-Drafts can be accessed at | |||
| http://www.ietf.org/ietf/1id-abstracts.txt. | http://www.ietf.org/ietf/1id-abstracts.txt. | |||
| The list of Internet-Draft Shadow Directories can be accessed at | The list of Internet-Draft Shadow Directories can be accessed at | |||
| http://www.ietf.org/shadow.html. | http://www.ietf.org/shadow.html. | |||
| This Internet-Draft will expire on August 27, 2008. | This Internet-Draft will expire on December 19, 2008. | |||
| Copyright Notice | ||||
| Copyright (C) The IETF Trust (2008). | ||||
| Abstract | Abstract | |||
| The Hypertext Transfer Protocol (HTTP) is an application-level | The Hypertext Transfer Protocol (HTTP) is an application-level | |||
| protocol for distributed, collaborative, hypermedia information | protocol for distributed, collaborative, hypermedia information | |||
| systems. HTTP has been in use by the World Wide Web global | systems. HTTP has been in use by the World Wide Web global | |||
| information initiative since 1990. This document is Part 1 of the | information initiative since 1990. This document is Part 1 of the | |||
| seven-part specification that defines the protocol referred to as | seven-part specification that defines the protocol referred to as | |||
| "HTTP/1.1" and, taken together, obsoletes RFC 2616. Part 1 provides | "HTTP/1.1" and, taken together, obsoletes RFC 2616. Part 1 provides | |||
| an overview of HTTP and its associated terminology, defines the | an overview of HTTP and its associated terminology, defines the | |||
| skipping to change at page 2, line 30 | skipping to change at page 2, line 26 | |||
| frames, and describes general security concerns for implementations. | frames, and describes general security concerns for implementations. | |||
| Editorial Note (To be removed by RFC Editor) | Editorial Note (To be removed by RFC Editor) | |||
| Discussion of this draft should take place on the HTTPBIS working | Discussion of this draft should take place on the HTTPBIS working | |||
| group mailing list (ietf-http-wg@w3.org). The current issues list is | group mailing list (ietf-http-wg@w3.org). The current issues list is | |||
| at <http://www.tools.ietf.org/wg/httpbis/trac/report/11> and related | at <http://www.tools.ietf.org/wg/httpbis/trac/report/11> and related | |||
| documents (including fancy diffs) can be found at | documents (including fancy diffs) can be found at | |||
| <http://www.tools.ietf.org/wg/httpbis/>. | <http://www.tools.ietf.org/wg/httpbis/>. | |||
| This draft incorporates those issue resolutions that were either | The changes in this draft are summarized in Appendix E.4. | |||
| collected in the original RFC2616 errata list | ||||
| (<http://purl.org/NET/http-errata>), or which were agreed upon on the | ||||
| mailing list between October 2006 and November 2007 (as published in | ||||
| "draft-lafon-rfc2616bis-03"). | ||||
| Table of Contents | Table of Contents | |||
| 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 5 | 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 5 | |||
| 1.1. Purpose . . . . . . . . . . . . . . . . . . . . . . . . . 5 | 1.1. Purpose . . . . . . . . . . . . . . . . . . . . . . . . . 5 | |||
| 1.2. Requirements . . . . . . . . . . . . . . . . . . . . . . . 6 | 1.2. Requirements . . . . . . . . . . . . . . . . . . . . . . . 6 | |||
| 1.3. Terminology . . . . . . . . . . . . . . . . . . . . . . . 6 | 1.3. Terminology . . . . . . . . . . . . . . . . . . . . . . . 6 | |||
| 1.4. Overall Operation . . . . . . . . . . . . . . . . . . . . 9 | 1.4. Overall Operation . . . . . . . . . . . . . . . . . . . . 9 | |||
| 2. Notational Conventions and Generic Grammar . . . . . . . . . . 11 | 2. Notational Conventions and Generic Grammar . . . . . . . . . . 11 | |||
| 2.1. Augmented BNF . . . . . . . . . . . . . . . . . . . . . . 11 | 2.1. Augmented BNF . . . . . . . . . . . . . . . . . . . . . . 11 | |||
| skipping to change at page 4, line 16 | skipping to change at page 4, line 16 | |||
| 8.2. Content-Length . . . . . . . . . . . . . . . . . . . . . . 40 | 8.2. Content-Length . . . . . . . . . . . . . . . . . . . . . . 40 | |||
| 8.3. Date . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 | 8.3. Date . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 | |||
| 8.3.1. Clockless Origin Server Operation . . . . . . . . . . 42 | 8.3.1. Clockless Origin Server Operation . . . . . . . . . . 42 | |||
| 8.4. Host . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 | 8.4. Host . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 | |||
| 8.5. TE . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 | 8.5. TE . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 | |||
| 8.6. Trailer . . . . . . . . . . . . . . . . . . . . . . . . . 44 | 8.6. Trailer . . . . . . . . . . . . . . . . . . . . . . . . . 44 | |||
| 8.7. Transfer-Encoding . . . . . . . . . . . . . . . . . . . . 44 | 8.7. Transfer-Encoding . . . . . . . . . . . . . . . . . . . . 44 | |||
| 8.8. Upgrade . . . . . . . . . . . . . . . . . . . . . . . . . 45 | 8.8. Upgrade . . . . . . . . . . . . . . . . . . . . . . . . . 45 | |||
| 8.9. Via . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 | 8.9. Via . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 | |||
| 9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 47 | 9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 47 | |||
| 10. Security Considerations . . . . . . . . . . . . . . . . . . . 47 | 9.1. Message Header Registration . . . . . . . . . . . . . . . 47 | |||
| 10. Security Considerations . . . . . . . . . . . . . . . . . . . 48 | ||||
| 10.1. Personal Information . . . . . . . . . . . . . . . . . . . 48 | 10.1. Personal Information . . . . . . . . . . . . . . . . . . . 48 | |||
| 10.2. Abuse of Server Log Information . . . . . . . . . . . . . 48 | 10.2. Abuse of Server Log Information . . . . . . . . . . . . . 48 | |||
| 10.3. Attacks Based On File and Path Names . . . . . . . . . . . 48 | 10.3. Attacks Based On File and Path Names . . . . . . . . . . . 49 | |||
| 10.4. DNS Spoofing . . . . . . . . . . . . . . . . . . . . . . . 49 | 10.4. DNS Spoofing . . . . . . . . . . . . . . . . . . . . . . . 49 | |||
| 10.5. Proxies and Caching . . . . . . . . . . . . . . . . . . . 49 | 10.5. Proxies and Caching . . . . . . . . . . . . . . . . . . . 50 | |||
| 10.6. Denial of Service Attacks on Proxies . . . . . . . . . . . 50 | 10.6. Denial of Service Attacks on Proxies . . . . . . . . . . . 50 | |||
| 11. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 50 | 11. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 50 | |||
| 12. References . . . . . . . . . . . . . . . . . . . . . . . . . . 51 | 12. References . . . . . . . . . . . . . . . . . . . . . . . . . . 52 | |||
| 12.1. Normative References . . . . . . . . . . . . . . . . . . . 51 | 12.1. Normative References . . . . . . . . . . . . . . . . . . . 52 | |||
| 12.2. Informative References . . . . . . . . . . . . . . . . . . 52 | 12.2. Informative References . . . . . . . . . . . . . . . . . . 53 | |||
| Appendix A. Internet Media Types . . . . . . . . . . . . . . . . 54 | Appendix A. Internet Media Types . . . . . . . . . . . . . . . . 55 | |||
| A.1. Internet Media Type message/http . . . . . . . . . . . . . 54 | A.1. Internet Media Type message/http . . . . . . . . . . . . . 55 | |||
| A.2. Internet Media Type application/http . . . . . . . . . . . 56 | A.2. Internet Media Type application/http . . . . . . . . . . . 56 | |||
| Appendix B. Tolerant Applications . . . . . . . . . . . . . . . . 57 | Appendix B. Tolerant Applications . . . . . . . . . . . . . . . . 57 | |||
| Appendix C. Conversion of Date Formats . . . . . . . . . . . . . 58 | Appendix C. Conversion of Date Formats . . . . . . . . . . . . . 58 | |||
| Appendix D. Compatibility with Previous Versions . . . . . . . . 58 | Appendix D. Compatibility with Previous Versions . . . . . . . . 58 | |||
| D.1. Changes from HTTP/1.0 . . . . . . . . . . . . . . . . . . 58 | D.1. Changes from HTTP/1.0 . . . . . . . . . . . . . . . . . . 59 | |||
| D.1.1. Changes to Simplify Multi-homed Web Servers and | D.1.1. Changes to Simplify Multi-homed Web Servers and | |||
| Conserve IP Addresses . . . . . . . . . . . . . . . . 59 | Conserve IP Addresses . . . . . . . . . . . . . . . . 59 | |||
| D.2. Compatibility with HTTP/1.0 Persistent Connections . . . . 59 | D.2. Compatibility with HTTP/1.0 Persistent Connections . . . . 60 | |||
| D.3. Changes from RFC 2068 . . . . . . . . . . . . . . . . . . 60 | D.3. Changes from RFC 2068 . . . . . . . . . . . . . . . . . . 60 | |||
| D.4. Changes from RFC 2616 . . . . . . . . . . . . . . . . . . 60 | D.4. Changes from RFC 2616 . . . . . . . . . . . . . . . . . . 61 | |||
| Appendix E. Change Log (to be removed by RFC Editor before | Appendix E. Change Log (to be removed by RFC Editor before | |||
| publication) . . . . . . . . . . . . . . . . . . . . 61 | publication) . . . . . . . . . . . . . . . . . . . . 61 | |||
| E.1. Since RFC2616 . . . . . . . . . . . . . . . . . . . . . . 61 | E.1. Since RFC2616 . . . . . . . . . . . . . . . . . . . . . . 61 | |||
| E.2. Since draft-ietf-httpbis-p1-messaging-00 . . . . . . . . . 61 | E.2. Since draft-ietf-httpbis-p1-messaging-00 . . . . . . . . . 61 | |||
| E.3. Since draft-ietf-httpbis-p1-messaging-01 . . . . . . . . . 62 | E.3. Since draft-ietf-httpbis-p1-messaging-01 . . . . . . . . . 63 | |||
| Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 | E.4. Since draft-ietf-httpbis-p1-messaging-02 . . . . . . . . . 64 | |||
| Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 67 | Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 | |||
| Intellectual Property and Copyright Statements . . . . . . . . . . 70 | Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 68 | |||
| Intellectual Property and Copyright Statements . . . . . . . . . . 71 | ||||
| 1. Introduction | 1. Introduction | |||
| The Hypertext Transfer Protocol (HTTP) is an application-level | The Hypertext Transfer Protocol (HTTP) is an application-level | |||
| protocol for distributed, collaborative, hypermedia information | protocol for distributed, collaborative, hypermedia information | |||
| systems. HTTP has been in use by the World-Wide Web global | systems. HTTP has been in use by the World-Wide Web global | |||
| information initiative since 1990. The first version of HTTP, | information initiative since 1990. The first version of HTTP, | |||
| commonly referred to as HTTP/0.9, was a simple protocol for raw data | commonly referred to as HTTP/0.9, was a simple protocol for raw data | |||
| transfer across the Internet with only a single method and no | transfer across the Internet with only a single method and no | |||
| metadata. HTTP/1.0, as defined by [RFC1945], improved the protocol | metadata. HTTP/1.0, as defined by [RFC1945], improved the protocol | |||
| skipping to change at page 15, line 46 | skipping to change at page 15, line 46 | |||
| A string of text is parsed as a single word if it is quoted using | A string of text is parsed as a single word if it is quoted using | |||
| double-quote marks. | double-quote marks. | |||
| quoted-string = ( DQUOTE *(qdtext | quoted-pair ) DQUOTE ) | quoted-string = ( DQUOTE *(qdtext | quoted-pair ) DQUOTE ) | |||
| qdtext = <any TEXT excluding DQUOTE and "\"> | qdtext = <any TEXT excluding DQUOTE and "\"> | |||
| The backslash character ("\") MAY be used as a single-character | The backslash character ("\") MAY be used as a single-character | |||
| quoting mechanism only within quoted-string and comment constructs. | quoting mechanism only within quoted-string and comment constructs. | |||
| quoted-pair = "\" CHAR | quoted-text = %x01-09 | | |||
| %x0B-0C | | ||||
| %x0E-FF ; Characters excluding NUL, CR and LF | ||||
| quoted-pair = "\" quoted-text | ||||
| 2.3. ABNF Rules defined in other Parts of the Specification | 2.3. ABNF Rules defined in other Parts of the Specification | |||
| The ABNF rules below are defined in other parts: | The ABNF rules below are defined in other parts: | |||
| request-header = <request-header, defined in [Part2], Section 4> | request-header = <request-header, defined in [Part2], Section 4> | |||
| response-header = <response-header, defined in [Part2], Section 6> | response-header = <response-header, defined in [Part2], Section 6> | |||
| accept-params = <accept-params, defined in [Part3], Section 6.1> | accept-params = <accept-params, defined in [Part3], Section 6.1> | |||
| entity-body = <entity-body, defined in [Part3], Section 4.2> | entity-body = <entity-body, defined in [Part3], Section 4.2> | |||
| skipping to change at page 16, line 41 | skipping to change at page 16, line 41 | |||
| The <minor> number is incremented when the changes made to the | The <minor> number is incremented when the changes made to the | |||
| protocol add features which do not change the general message parsing | protocol add features which do not change the general message parsing | |||
| algorithm, but which may add to the message semantics and imply | algorithm, but which may add to the message semantics and imply | |||
| additional capabilities of the sender. The <major> number is | additional capabilities of the sender. The <major> number is | |||
| incremented when the format of a message within the protocol is | incremented when the format of a message within the protocol is | |||
| changed. See [RFC2145] for a fuller explanation. | changed. See [RFC2145] for a fuller explanation. | |||
| The version of an HTTP message is indicated by an HTTP-Version field | The version of an HTTP message is indicated by an HTTP-Version field | |||
| in the first line of the message. HTTP-Version is case-sensitive. | in the first line of the message. HTTP-Version is case-sensitive. | |||
| HTTP-Version = "HTTP" "/" 1*DIGIT "." 1*DIGIT | HTTP-Version = HTTP-Prot-Name "/" 1*DIGIT "." 1*DIGIT | |||
| HTTP-Prot-Name = %x48.54.54.50 ; "HTTP", case-sensitive | ||||
| Note that the major and minor numbers MUST be treated as separate | Note that the major and minor numbers MUST be treated as separate | |||
| integers and that each MAY be incremented higher than a single digit. | integers and that each MAY be incremented higher than a single digit. | |||
| Thus, HTTP/2.4 is a lower version than HTTP/2.13, which in turn is | Thus, HTTP/2.4 is a lower version than HTTP/2.13, which in turn is | |||
| lower than HTTP/12.3. Leading zeros MUST be ignored by recipients | lower than HTTP/12.3. Leading zeros MUST be ignored by recipients | |||
| and MUST NOT be sent. | and MUST NOT be sent. | |||
| An application that sends a request or response message that includes | An application that sends a request or response message that includes | |||
| HTTP-Version of "HTTP/1.1" MUST be at least conditionally compliant | HTTP-Version of "HTTP/1.1" MUST be at least conditionally compliant | |||
| with this specification. Applications that are at least | with this specification. Applications that are at least | |||
| skipping to change at page 20, line 8 | skipping to change at page 20, line 10 | |||
| All HTTP date/time stamps MUST be represented in Greenwich Mean Time | All HTTP date/time stamps MUST be represented in Greenwich Mean Time | |||
| (GMT), without exception. For the purposes of HTTP, GMT is exactly | (GMT), without exception. For the purposes of HTTP, GMT is exactly | |||
| equal to UTC (Coordinated Universal Time). This is indicated in the | equal to UTC (Coordinated Universal Time). This is indicated in the | |||
| first two formats by the inclusion of "GMT" as the three-letter | first two formats by the inclusion of "GMT" as the three-letter | |||
| abbreviation for time zone, and MUST be assumed when reading the | abbreviation for time zone, and MUST be assumed when reading the | |||
| asctime format. HTTP-date is case sensitive and MUST NOT include | asctime format. HTTP-date is case sensitive and MUST NOT include | |||
| additional LWS beyond that specifically included as SP in the | additional LWS beyond that specifically included as SP in the | |||
| grammar. | grammar. | |||
| HTTP-date = rfc1123-date | rfc850-date | asctime-date | HTTP-date = rfc1123-date | obsolete-date | |||
| obsolete-date = rfc850-date | asctime-date | ||||
| rfc1123-date = wkday "," SP date1 SP time SP "GMT" | rfc1123-date = wkday "," SP date1 SP time SP "GMT" | |||
| rfc850-date = weekday "," SP date2 SP time SP "GMT" | rfc850-date = weekday "," SP date2 SP time SP "GMT" | |||
| asctime-date = wkday SP date3 SP time SP 4DIGIT | asctime-date = wkday SP date3 SP time SP 4DIGIT | |||
| date1 = 2DIGIT SP month SP 4DIGIT | date1 = 2DIGIT SP month SP 4DIGIT | |||
| ; day month year (e.g., 02 Jun 1982) | ; day month year (e.g., 02 Jun 1982) | |||
| date2 = 2DIGIT "-" month "-" 2DIGIT | date2 = 2DIGIT "-" month "-" 2DIGIT | |||
| ; day-month-year (e.g., 02-Jun-82) | ; day-month-year (e.g., 02-Jun-82) | |||
| date3 = month SP ( 2DIGIT | ( SP 1DIGIT )) | date3 = month SP ( 2DIGIT | ( SP 1DIGIT )) | |||
| ; month day (e.g., Jun 2) | ; month day (e.g., Jun 2) | |||
| time = 2DIGIT ":" 2DIGIT ":" 2DIGIT | time = 2DIGIT ":" 2DIGIT ":" 2DIGIT | |||
| skipping to change at page 46, line 22 | skipping to change at page 46, line 22 | |||
| version rules of Section 3.1 and future updates to this | version rules of Section 3.1 and future updates to this | |||
| specification. Any token can be used as a protocol name; however, it | specification. Any token can be used as a protocol name; however, it | |||
| will only be useful if both the client and server associate the name | will only be useful if both the client and server associate the name | |||
| with the same protocol. | with the same protocol. | |||
| 8.9. Via | 8.9. Via | |||
| The Via general-header field MUST be used by gateways and proxies to | The Via general-header field MUST be used by gateways and proxies to | |||
| indicate the intermediate protocols and recipients between the user | indicate the intermediate protocols and recipients between the user | |||
| agent and the server on requests, and between the origin server and | agent and the server on requests, and between the origin server and | |||
| the client on responses. It is analogous to the "Received" field of | the client on responses. It is analogous to the "Received" field | |||
| [RFC2822] and is intended to be used for tracking message forwards, | defined in Section 3.6.7 of [RFC2822] and is intended to be used for | |||
| avoiding request loops, and identifying the protocol capabilities of | tracking message forwards, avoiding request loops, and identifying | |||
| all senders along the request/response chain. | the protocol capabilities of all senders along the request/response | |||
| chain. | ||||
| Via = "Via" ":" 1#( received-protocol received-by [ comment ] ) | Via = "Via" ":" 1#( received-protocol received-by [ comment ] ) | |||
| received-protocol = [ protocol-name "/" ] protocol-version | received-protocol = [ protocol-name "/" ] protocol-version | |||
| protocol-name = token | protocol-name = token | |||
| protocol-version = token | protocol-version = token | |||
| received-by = ( uri-host [ ":" port ] ) | pseudonym | received-by = ( uri-host [ ":" port ] ) | pseudonym | |||
| pseudonym = token | pseudonym = token | |||
| The received-protocol indicates the protocol version of the message | The received-protocol indicates the protocol version of the message | |||
| received by the server or client along each segment of the request/ | received by the server or client along each segment of the request/ | |||
| skipping to change at page 47, line 45 | skipping to change at page 47, line 46 | |||
| Via: 1.0 ricky, 1.1 mertz, 1.0 lucy | Via: 1.0 ricky, 1.1 mertz, 1.0 lucy | |||
| Applications SHOULD NOT combine multiple entries unless they are all | Applications SHOULD NOT combine multiple entries unless they are all | |||
| under the same organizational control and the hosts have already been | under the same organizational control and the hosts have already been | |||
| replaced by pseudonyms. Applications MUST NOT combine entries which | replaced by pseudonyms. Applications MUST NOT combine entries which | |||
| have different received-protocol values. | have different received-protocol values. | |||
| 9. IANA Considerations | 9. IANA Considerations | |||
| [[anchor1: TBD.]] | 9.1. Message Header Registration | |||
| The Message Header Registry located at <http://www.iana.org/ | ||||
| assignments/message-headers/message-header-index.html> should be | ||||
| updated with the permanent registrations below (see [RFC3864]): | ||||
| +-------------------+----------+----------+-------------+ | ||||
| | Header Field Name | Protocol | Status | Reference | | ||||
| +-------------------+----------+----------+-------------+ | ||||
| | Connection | http | standard | Section 8.1 | | ||||
| | Content-Length | http | standard | Section 8.2 | | ||||
| | Date | http | standard | Section 8.3 | | ||||
| | Host | http | standard | Section 8.4 | | ||||
| | TE | http | standard | Section 8.5 | | ||||
| | Trailer | http | standard | Section 8.6 | | ||||
| | Transfer-Encoding | http | standard | Section 8.7 | | ||||
| | Upgrade | http | standard | Section 8.8 | | ||||
| | Via | http | standard | Section 8.9 | | ||||
| +-------------------+----------+----------+-------------+ | ||||
| The change controller is: "IETF (iesg@ietf.org) - Internet | ||||
| Engineering Task Force". | ||||
| 10. Security Considerations | 10. Security Considerations | |||
| This section is meant to inform application developers, information | This section is meant to inform application developers, information | |||
| providers, and users of the security limitations in HTTP/1.1 as | providers, and users of the security limitations in HTTP/1.1 as | |||
| described by this document. The discussion does not include | described by this document. The discussion does not include | |||
| definitive solutions to the problems revealed, though it does make | definitive solutions to the problems revealed, though it does make | |||
| some suggestions for reducing security risks. | some suggestions for reducing security risks. | |||
| 10.1. Personal Information | 10.1. Personal Information | |||
| skipping to change at page 51, line 43 | skipping to change at page 52, line 16 | |||
| [ISO-8859-1] | [ISO-8859-1] | |||
| International Organization for Standardization, | International Organization for Standardization, | |||
| "Information technology -- 8-bit single-byte coded graphic | "Information technology -- 8-bit single-byte coded graphic | |||
| character sets -- Part 1: Latin alphabet No. 1", ISO/ | character sets -- Part 1: Latin alphabet No. 1", ISO/ | |||
| IEC 8859-1:1998, 1998. | IEC 8859-1:1998, 1998. | |||
| [Part2] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., | [Part2] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., | |||
| Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., | Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., | |||
| and J. Reschke, Ed., "HTTP/1.1, part 2: Message | and J. Reschke, Ed., "HTTP/1.1, part 2: Message | |||
| Semantics", draft-ietf-httpbis-p2-semantics-02 (work in | Semantics", draft-ietf-httpbis-p2-semantics-03 (work in | |||
| progress), February 2008. | progress), June 2008. | |||
| [Part3] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., | [Part3] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., | |||
| Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., | Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., | |||
| and J. Reschke, Ed., "HTTP/1.1, part 3: Message Payload | and J. Reschke, Ed., "HTTP/1.1, part 3: Message Payload | |||
| and Content Negotiation", draft-ietf-httpbis-p3-payload-02 | and Content Negotiation", draft-ietf-httpbis-p3-payload-03 | |||
| (work in progress), February 2008. | (work in progress), June 2008. | |||
| [Part5] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., | [Part5] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., | |||
| Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., | Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., | |||
| and J. Reschke, Ed., "HTTP/1.1, part 5: Range Requests and | and J. Reschke, Ed., "HTTP/1.1, part 5: Range Requests and | |||
| Partial Responses", draft-ietf-httpbis-p5-range-02 (work | Partial Responses", draft-ietf-httpbis-p5-range-03 (work | |||
| in progress), February 2008. | in progress), June 2008. | |||
| [Part6] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., | [Part6] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., | |||
| Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., | Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., | |||
| and J. Reschke, Ed., "HTTP/1.1, part 6: Caching", | and J. Reschke, Ed., "HTTP/1.1, part 6: Caching", | |||
| draft-ietf-httpbis-p6-cache-02 (work in progress), | draft-ietf-httpbis-p6-cache-03 (work in progress), | |||
| February 2008. | June 2008. | |||
| [RFC2045] Freed, N. and N. Borenstein, "Multipurpose Internet Mail | [RFC2045] Freed, N. and N. Borenstein, "Multipurpose Internet Mail | |||
| Extensions (MIME) Part One: Format of Internet Message | Extensions (MIME) Part One: Format of Internet Message | |||
| Bodies", RFC 2045, November 1996. | Bodies", RFC 2045, November 1996. | |||
| [RFC2047] Moore, K., "MIME (Multipurpose Internet Mail Extensions) | [RFC2047] Moore, K., "MIME (Multipurpose Internet Mail Extensions) | |||
| Part Three: Message Header Extensions for Non-ASCII Text", | Part Three: Message Header Extensions for Non-ASCII Text", | |||
| RFC 2047, November 1996. | RFC 2047, November 1996. | |||
| [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate | [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate | |||
| skipping to change at page 54, line 13 | skipping to change at page 54, line 35 | |||
| [RFC2616] Fielding, R., Gettys, J., Mogul, J., Frystyk, H., | [RFC2616] Fielding, R., Gettys, J., Mogul, J., Frystyk, H., | |||
| Masinter, L., Leach, P., and T. Berners-Lee, "Hypertext | Masinter, L., Leach, P., and T. Berners-Lee, "Hypertext | |||
| Transfer Protocol -- HTTP/1.1", RFC 2616, June 1999. | Transfer Protocol -- HTTP/1.1", RFC 2616, June 1999. | |||
| [RFC2821] Klensin, J., "Simple Mail Transfer Protocol", RFC 2821, | [RFC2821] Klensin, J., "Simple Mail Transfer Protocol", RFC 2821, | |||
| April 2001. | April 2001. | |||
| [RFC2822] Resnick, P., "Internet Message Format", RFC 2822, | [RFC2822] Resnick, P., "Internet Message Format", RFC 2822, | |||
| April 2001. | April 2001. | |||
| [RFC3864] Klyne, G., Nottingham, M., and J. Mogul, "Registration | ||||
| Procedures for Message Header Fields", BCP 90, RFC 3864, | ||||
| September 2004. | ||||
| [RFC3977] Feather, C., "Network News Transfer Protocol (NNTP)", | [RFC3977] Feather, C., "Network News Transfer Protocol (NNTP)", | |||
| RFC 3977, October 2006. | RFC 3977, October 2006. | |||
| [RFC4288] Freed, N. and J. Klensin, "Media Type Specifications and | [RFC4288] Freed, N. and J. Klensin, "Media Type Specifications and | |||
| Registration Procedures", BCP 13, RFC 4288, December 2005. | Registration Procedures", BCP 13, RFC 4288, December 2005. | |||
| [RFC822] Crocker, D., "Standard for the format of ARPA Internet | [RFC822] Crocker, D., "Standard for the format of ARPA Internet | |||
| text messages", STD 11, RFC 822, August 1982. | text messages", STD 11, RFC 822, August 1982. | |||
| [RFC959] Postel, J. and J. Reynolds, "File Transfer Protocol", | [RFC959] Postel, J. and J. Reynolds, "File Transfer Protocol", | |||
| skipping to change at page 60, line 48 | skipping to change at page 61, line 23 | |||
| codings), a new header field (TE) and enabling trailer headers in the | codings), a new header field (TE) and enabling trailer headers in the | |||
| future. Transfer encoding is a major performance benefit, so it was | future. Transfer encoding is a major performance benefit, so it was | |||
| worth fixing [Nie1997]. TE also solves another, obscure, downward | worth fixing [Nie1997]. TE also solves another, obscure, downward | |||
| interoperability problem that could have occurred due to interactions | interoperability problem that could have occurred due to interactions | |||
| between authentication trailers, chunked encoding and HTTP/1.0 | between authentication trailers, chunked encoding and HTTP/1.0 | |||
| clients.(Section 3.4, 3.4.1, and 8.5) | clients.(Section 3.4, 3.4.1, and 8.5) | |||
| D.4. Changes from RFC 2616 | D.4. Changes from RFC 2616 | |||
| The CHAR rule does not allow the NUL character anymore (this affects | The CHAR rule does not allow the NUL character anymore (this affects | |||
| the comment and quoted-string rules). (Section 2.2) | the comment and quoted-string rules). Furthermore, the quoted-pair | |||
| rule does not allow escaping NUL, CR or LF anymore. (Section 2.2) | ||||
| Clarify that HTTP-Version is case sensitive. (Section 3.1) | Clarify that HTTP-Version is case sensitive. (Section 3.1) | |||
| Remove reference to non-existant identity transfer-coding value | Remove reference to non-existant identity transfer-coding value | |||
| tokens. (Sections 3.4 and 4.4) | tokens. (Sections 3.4 and 4.4) | |||
| Clarification that the chunk length does not include the count of the | Clarification that the chunk length does not include the count of the | |||
| octets in the chunk header and trailer. (Section 3.4.1) | octets in the chunk header and trailer. (Section 3.4.1) | |||
| Fix BNF to add query, as the abs_path production in Section 3 of | Fix BNF to add query, as the abs_path production in Section 3 of | |||
| [RFC2396] doesn't define it. (Section 5.1.2) | [RFC2396] doesn't define it. (Section 5.1.2) | |||
| Clarify exactly when close connection options must be sent. | Clarify exactly when close connection options must be sent. | |||
| skipping to change at page 63, line 43 | skipping to change at page 64, line 22 | |||
| o Move "Product Tokens" section (back) into Part 1, as "token" is | o Move "Product Tokens" section (back) into Part 1, as "token" is | |||
| used in the definition of the Upgrade header. | used in the definition of the Upgrade header. | |||
| o Add explicit references to BNF syntax and rules imported from | o Add explicit references to BNF syntax and rules imported from | |||
| other parts of the specification. | other parts of the specification. | |||
| o Rewrite prose rule "token" in terms of "tchar", rewrite prose rule | o Rewrite prose rule "token" in terms of "tchar", rewrite prose rule | |||
| "TEXT". | "TEXT". | |||
| E.4. Since draft-ietf-httpbis-p1-messaging-02 | ||||
| Closed issues: | ||||
| o <http://www3.tools.ietf.org/wg/httpbis/trac/ticket/51>: "HTTP-date | ||||
| vs. rfc1123-date" | ||||
| o <http://www3.tools.ietf.org/wg/httpbis/trac/ticket/64>: "WS in | ||||
| quoted-pair" | ||||
| Ongoing work on IANA Message Header Registration | ||||
| (<http://www3.tools.ietf.org/wg/httpbis/trac/ticket/40>): | ||||
| o Reference RFC 3984, and update header registrations for headers | ||||
| defined in this document. | ||||
| Ongoing work on ABNF conversion | ||||
| (<http://www3.tools.ietf.org/wg/httpbis/trac/ticket/36>): | ||||
| o Replace string literals when the string really is case-sensitive | ||||
| (HTTP-Version). | ||||
| Index | Index | |||
| A | A | |||
| application/http Media Type 56 | application/http Media Type 56 | |||
| C | C | |||
| cache 8 | cache 8 | |||
| cacheable 9 | cacheable 9 | |||
| client 7 | client 7 | |||
| connection 6 | connection 6 | |||
| skipping to change at page 65, line 11 | skipping to change at page 66, line 12 | |||
| field-content 25 | field-content 25 | |||
| field-name 25 | field-name 25 | |||
| field-value 25 | field-value 25 | |||
| general-header 28 | general-header 28 | |||
| generic-message 24 | generic-message 24 | |||
| HEX 15 | HEX 15 | |||
| Host 42 | Host 42 | |||
| HTAB 14 | HTAB 14 | |||
| HTTP-date 20 | HTTP-date 20 | |||
| HTTP-message 24 | HTTP-message 24 | |||
| HTTP-Prot-Name 16 | ||||
| http-URL 18 | http-URL 18 | |||
| HTTP-Version 16 | HTTP-Version 16 | |||
| last-chunk 22 | last-chunk 22 | |||
| LF 14 | LF 14 | |||
| LWS 14 | LWS 14 | |||
| message-body 25 | message-body 25 | |||
| message-header 25 | message-header 25 | |||
| Method 29 | Method 29 | |||
| month 20 | month 20 | |||
| obsolete-date 20 | ||||
| OCTET 14 | OCTET 14 | |||
| parameter 20 | parameter 20 | |||
| path-absolute 18 | path-absolute 18 | |||
| port 18 | port 18 | |||
| product 23 | product 23 | |||
| product-version 23 | product-version 23 | |||
| protocol-name 46 | protocol-name 46 | |||
| protocol-version 46 | protocol-version 46 | |||
| pseudonym 46 | pseudonym 46 | |||
| qdtext 15 | qdtext 15 | |||
| query 18 | query 18 | |||
| quoted-pair 15 | quoted-pair 15 | |||
| quoted-string 15 | quoted-string 15 | |||
| quoted-text 15 | ||||
| Reason-Phrase 32 | Reason-Phrase 32 | |||
| received-by 46 | received-by 46 | |||
| received-protocol 46 | received-protocol 46 | |||
| relativeURI 18 | relativeURI 18 | |||
| Request 28 | Request 28 | |||
| Request-Line 28 | Request-Line 28 | |||
| Request-URI 29 | Request-URI 29 | |||
| Response 31 | Response 31 | |||
| rfc850-date 20 | rfc850-date 20 | |||
| rfc1123-date 20 | rfc1123-date 20 | |||
| skipping to change at page 66, line 32 | skipping to change at page 67, line 36 | |||
| Date 41 | Date 41 | |||
| Host 42 | Host 42 | |||
| TE 43 | TE 43 | |||
| Trailer 44 | Trailer 44 | |||
| Transfer-Encoding 44 | Transfer-Encoding 44 | |||
| Upgrade 45 | Upgrade 45 | |||
| Via 46 | Via 46 | |||
| Host header 42 | Host header 42 | |||
| I | I | |||
| implied *LWS 13 | ||||
| inbound 9 | inbound 9 | |||
| M | M | |||
| Media Type | Media Type | |||
| application/http 56 | application/http 56 | |||
| message/http 54 | message/http 55 | |||
| message 6 | message 6 | |||
| message/http Media Type 54 | message/http Media Type 55 | |||
| O | O | |||
| origin server 8 | origin server 8 | |||
| outbound 9 | outbound 9 | |||
| P | P | |||
| proxy 8 | proxy 8 | |||
| R | R | |||
| representation 7 | representation 7 | |||
| request 6 | request 6 | |||
| resource 7 | resource 7 | |||
| response 6 | response 6 | |||
| S | S | |||
| server 8 | server 8 | |||
| T | T | |||
| skipping to change at page 70, line 44 | skipping to change at line 3284 | |||
| attempt made to obtain a general license or permission for the use of | attempt made to obtain a general license or permission for the use of | |||
| such proprietary rights by implementers or users of this | such proprietary rights by implementers or users of this | |||
| specification can be obtained from the IETF on-line IPR repository at | specification can be obtained from the IETF on-line IPR repository at | |||
| http://www.ietf.org/ipr. | http://www.ietf.org/ipr. | |||
| The IETF invites any interested party to bring to its attention any | The IETF invites any interested party to bring to its attention any | |||
| copyrights, patents or patent applications, or other proprietary | copyrights, patents or patent applications, or other proprietary | |||
| rights that may cover technology that may be required to implement | rights that may cover technology that may be required to implement | |||
| this standard. Please address the information to the IETF at | this standard. Please address the information to the IETF at | |||
| ietf-ipr@ietf.org. | ietf-ipr@ietf.org. | |||
| Acknowledgment | ||||
| Funding for the RFC Editor function is provided by the IETF | ||||
| Administrative Support Activity (IASA). | ||||
| End of changes. 34 change blocks. | ||||
| 48 lines changed or deleted | 100 lines changed or added | |||
This html diff was produced by rfcdiff 1.34. The latest version is available from http://tools.ietf.org/tools/rfcdiff/ | ||||