HTTP/1.1 Drafts: Combined Table of Contents

Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing

• 1.   Introduction
  • 1.1.   Requirements Notation
  • 1.2.   Syntax Notation
• 2.   Architecture
  • 2.1.   Client/Server Messaging
  • 2.2.   Implementation Diversity
  • 2.3.   Intermediaries
  • 2.4.   Caches
  • 2.5.   Conformance and Error Handling
  • 2.6.   Protocol Versioning
  • 2.7.   Uniform Resource Identifiers
    • 2.7.1.   http URI Scheme
    • 2.7.2.   https URI Scheme
    • 2.7.3.   http and https URI Normalization and Comparison
• 3.   Message Format
  • 3.1.   Start Line
    • 3.1.1.   Request Line
    • 3.1.2.   Status Line
  • 3.2.   Header Fields
    • 3.2.1.   Field Extensibility
    • 3.2.2.   Field Order
    • 3.2.3.   Whitespace
    • 3.2.4.   Field Parsing
    • 3.2.5.   Field Limits
    • 3.2.6.   Field Value Components
  • 3.3.   Message Body
    • 3.3.1.   Transfer-Encoding
    • 3.3.2.   Content-Length
    • 3.3.3.   Message Body Length
  • 3.4.   Handling Incomplete Messages
  • 3.5.   Message Parsing Robustness
• 4.   Transfer Codings
  • 4.1.   Chunked Transfer Coding
    • 4.1.1.   Chunk Extensions
    • 4.1.2.   Chunked Trailer Part
    • 4.1.3.   Decoding Chunked
  • 4.2.   Compression Codings
    • 4.2.1.   Compress Coding
    • 4.2.2.   Deflate Coding
    • 4.2.3.   Gzip Coding
  • 4.3.   TE
  • 4.4.   Trailer
• 5.   Message Routing
  • 5.1.   Identifying a Target Resource
  • 5.2.   Connecting Inbound
  • 5.3.   Request Target
    • 5.3.1.   origin-form
    • 5.3.2.   absolute-form
    • 5.3.3.   authority-form
    • 5.3.4.   asterisk-form
  • 5.4.   Host
  • 5.5.   Effective Request URI
  • 5.6.   Associating a Response to a Request
  • 5.7.   Message Forwarding
    • 5.7.1.   Via
    • 5.7.2.   Transformations
• 6.   Connection Management
  • 6.1.   Connection
  • 6.2.   Establishment
  • 6.3.   Persistence
    • 6.3.1.   Retrying Requests
    • 6.3.2.   Pipelining
  • 6.4.   Concurrency
  • 6.5.   Failures and Timeouts
  • 6.6.   Tear-down
  • 6.7.   Upgrade
• 7.   ABNF List Extension: #rule
• 8.   IANA Considerations
  • 8.1.   Header Field Registration
  • 8.2.   URI Scheme Registration
  • 8.3.   Internet Media Type Registration
    • 8.3.1.   Internet Media Type message/http
    • 8.3.2.   Internet Media Type application/http
  • 8.4.   Transfer Coding Registry
    • 8.4.1.   Procedure
    • 8.4.2.   Registration
  • 8.5.   Content Coding Registration
  • 8.6.   Upgrade Token Registry
    • 8.6.1.   Procedure
    • 8.6.2.   Upgrade Token Registration
• 9.   Security Considerations
  • 9.1.   Establishing Authority
  • 9.2.   Risks of Intermediaries
  • 9.3.   Attacks via Protocol Element Length
  • 9.4.   Response Splitting
  • 9.5.   Request Smuggling
  • 9.6.   Message Integrity
  • 9.7.   Message Confidentiality
  • 9.8.   Privacy of Server Log Information
• 10.   References
  • 10.1.   Normative References
  • 10.2.   Informative References
• A.   HTTP Version History
  • A.1.   Changes from HTTP/1.0
    • A.1.1.   Multihomed Web Servers
    • A.1.2.   Keep-Alive Connections
    • A.1.3.   Introduction of Transfer-Encoding
  • A.2.   Changes from RFC 7230
• B.   Collected ABNF
• C.   Change Log
  • C.1.   Since RFC 7230
• Acknowledgments
• Index
• Authors' Addresses

Hypertext Transfer Protocol (HTTP): Semantics and Content

• 1.   Introduction
  • 1.1.   Conformance and Error Handling
  • 1.2.   Syntax Notation
• 2.   Resources
• 3.   Representations
  • 3.1.   Representation Metadata
    • 3.1.1.   Processing Representation Data
    • 3.1.2.   Encoding for Compression or Integrity
    • 3.1.3.   Audience Language
    • 3.1.4.   Identification
  • 3.2.   Representation Data
  • 3.3.   Payload Semantics
  • 3.4.   Content Negotiation
    • 3.4.1.   Proactive Negotiation
    • 3.4.2.   Reactive Negotiation
• 4.   Request Methods
  • 4.1.   Overview
  • 4.2.   Common Method Properties
    • 4.2.1.   Safe Methods
    • 4.2.2.   Idempotent Methods
    • 4.2.3.   Cacheable Methods
  • 4.3.   Method Definitions
    • 4.3.1.   GET
    • 4.3.2.   HEAD
    • 4.3.3.   POST
    • 4.3.4.   PUT
    • 4.3.5.   DELETE
    • 4.3.6.   CONNECT
    • 4.3.7.   OPTIONS
    • 4.3.8.   TRACE
• 5.   Request Header Fields
  • 5.1.   Controls
    • 5.1.1.   Expect
    • 5.1.2.   Max-Forwards
  • 5.2.   Conditionals
  • 5.3.   Content Negotiation
    • 5.3.1.   Quality Values
    • 5.3.2.   Accept
    • 5.3.3.   Accept-Charset
    • 5.3.4.   Accept-Encoding
    • 5.3.5.   Accept-Language
  • 5.4.   Authentication Credentials
  • 5.5.   Request Context
    • 5.5.1.   From
    • 5.5.2.   Referer
    • 5.5.3.   User-Agent
• 6.   Response Status Codes
  • 6.1.   Overview of Status Codes
  • 6.2.   Informational 1xx
    • 6.2.1.   100 Continue
    • 6.2.2.   101 Switching Protocols
  • 6.3.   Successful 2xx
    • 6.3.1.   200 OK
    • 6.3.2.   201 Created
    • 6.3.3.   202 Accepted
    • 6.3.4.   203 Non-Authoritative Information
    • 6.3.5.   204 No Content
    • 6.3.6.   205 Reset Content
  • 6.4.   Redirection 3xx
    • 6.4.1.   300 Multiple Choices
    • 6.4.2.   301 Moved Permanently
    • 6.4.3.   302 Found
    • 6.4.4.   303 See Other
    • 6.4.5.   305 Use Proxy
    • 6.4.6.   306 (Unused)
    • 6.4.7.   307 Temporary Redirect
  • 6.5.   Client Error 4xx
    • 6.5.1.   400 Bad Request
    • 6.5.2.   402 Payment Required
    • 6.5.3.   403 Forbidden
    • 6.5.4.   404 Not Found
    • 6.5.5.   405 Method Not Allowed
    • 6.5.6.   406 Not Acceptable
    • 6.5.7.   408 Request Timeout
    • 6.5.8.   409 Conflict
    • 6.5.9.   410 Gone
    • 6.5.10.   411 Length Required
    • 6.5.11.   413 Payload Too Large
    • 6.5.12.   414 URI Too Long
    • 6.5.13.   415 Unsupported Media Type
    • 6.5.14.   417 Expectation Failed
    • 6.5.15.   426 Upgrade Required
  • 6.6.   Server Error 5xx
    • 6.6.1.   500 Internal Server Error
    • 6.6.2.   501 Not Implemented
    • 6.6.3.   502 Bad Gateway
    • 6.6.4.   503 Service Unavailable
    • 6.6.5.   504 Gateway Timeout
    • 6.6.6.   505 HTTP Version Not Supported
• 7.   Response Header Fields
  • 7.1.   Control Data
    • 7.1.1.   Origination Date
    • 7.1.2.   Location
    • 7.1.3.   Retry-After
    • 7.1.4.   Vary
  • 7.2.   Validator Header Fields
  • 7.3.   Authentication Challenges
  • 7.4.   Response Context
    • 7.4.1.   Allow
    • 7.4.2.   Server
• 8.   IANA Considerations
  • 8.1.   Method Registry
    • 8.1.1.   Procedure
    • 8.1.2.   Considerations for New Methods
    • 8.1.3.   Registrations
  • 8.2.   Status Code Registry
    • 8.2.1.   Procedure
    • 8.2.2.   Considerations for New Status Codes
    • 8.2.3.   Registrations
  • 8.3.   Header Field Registry
    • 8.3.1.   Considerations for New Header Fields
    • 8.3.2.   Registrations
  • 8.4.   Content Coding Registry
    • 8.4.1.   Procedure
    • 8.4.2.   Registrations
• 9.   Security Considerations
  • 9.1.   Attacks Based on File and Path Names
  • 9.2.   Attacks Based on Command, Code, or Query Injection
  • 9.3.   Disclosure of Personal Information
  • 9.4.   Disclosure of Sensitive Information in URIs
  • 9.5.   Disclosure of Fragment after Redirects
  • 9.6.   Disclosure of Product Information
  • 9.7.   Browser Fingerprinting
• 10.   References
  • 10.1.   Normative References
  • 10.2.   Informative References
• A.   Differences between HTTP and MIME
  • A.1.   MIME-Version
  • A.2.   Conversion to Canonical Form
  • A.3.   Conversion of Date Formats
  • A.4.   Conversion of Content-Encoding
  • A.5.   Conversion of Content-Transfer-Encoding
  • A.6.   MHTML and Line Length Limitations
• B.   Changes from RFC 7231
• C.   Imported ABNF
• D.   Collected ABNF
• E.   Change Log
  • E.1.   Since RFC 7231
• Acknowledgments
• Index
• Authors' Addresses

Hypertext Transfer Protocol (HTTP): Conditional Requests

• 1.   Introduction
  • 1.1.   Conformance and Error Handling
  • 1.2.   Syntax Notation
• 2.   Validators
  • 2.1.   Weak versus Strong
  • 2.2.   Last-Modified
    • 2.2.1.   Generation
    • 2.2.2.   Comparison
  • 2.3.   ETag
    • 2.3.1.   Generation
    • 2.3.2.   Comparison
    • 2.3.3.   Example: Entity-Tags Varying on Content-Negotiated Resources
  • 2.4.   When to Use Entity-Tags and Last-Modified Dates
• 3.   Precondition Header Fields
  • 3.1.   If-Match
  • 3.2.   If-None-Match
  • 3.3.   If-Modified-Since
  • 3.4.   If-Unmodified-Since
  • 3.5.   If-Range
• 4.   Status Code Definitions
  • 4.1.   304 Not Modified
  • 4.2.   412 Precondition Failed
• 5.   Evaluation
• 6.   Precedence
• 7.   IANA Considerations
  • 7.1.   Status Code Registration
  • 7.2.   Header Field Registration
• 8.   Security Considerations
• 9.   References
  • 9.1.   Normative References
  • 9.2.   Informative References
• A.   Changes from RFC 7232
• B.   Imported ABNF
• C.   Collected ABNF
• D.   Change Log
  • D.1.   Since RFC 7232
• Acknowledgments
• Index
• Authors' Addresses

Hypertext Transfer Protocol (HTTP): Range Requests

• 1.   Introduction
  • 1.1.   Conformance and Error Handling
  • 1.2.   Syntax Notation
• 2.   Range Units
  • 2.1.   Byte Ranges
  • 2.2.   Other Range Units
  • 2.3.   Accept-Ranges
• 3.   Range Requests
  • 3.1.   Range
  • 3.2.   If-Range
• 4.   Responses to a Range Request
  • 4.1.   206 Partial Content
  • 4.2.   Content-Range
  • 4.3.   Combining Ranges
  • 4.4.   416 Range Not Satisfiable
• 5.   IANA Considerations
  • 5.1.   Range Unit Registry
    • 5.1.1.   Procedure
    • 5.1.2.   Registrations
  • 5.2.   Status Code Registration
  • 5.3.   Header Field Registration
  • 5.4.   Internet Media Type Registration
    • 5.4.1.   Internet Media Type multipart/byteranges
• 6.   Security Considerations
  • 6.1.   Denial-of-Service Attacks Using Range
• 7.   References
  • 7.1.   Normative References
  • 7.2.   Informative References
• A.   Internet Media Type multipart/byteranges
• B.   Changes from RFC 7233
• C.   Imported ABNF
• D.   Collected ABNF
• E.   Change Log
  • E.1.   Since RFC 7233
• Acknowledgments
• Index
• Authors' Addresses

Hypertext Transfer Protocol (HTTP): Caching

• 1.   Introduction
  • 1.1.   Conformance and Error Handling
  • 1.2.   Syntax Notation
    • 1.2.1.   Delta Seconds
• 2.   Overview of Cache Operation
• 3.   Storing Responses in Caches
  • 3.1.   Storing Incomplete Responses
  • 3.2.   Storing Responses to Authenticated Requests
  • 3.3.   Combining Partial Content
• 4.   Constructing Responses from Caches
  • 4.1.   Calculating Secondary Keys with Vary
  • 4.2.   Freshness
    • 4.2.1.   Calculating Freshness Lifetime
    • 4.2.2.   Calculating Heuristic Freshness
    • 4.2.3.   Calculating Age
    • 4.2.4.   Serving Stale Responses
  • 4.3.   Validation
    • 4.3.1.   Sending a Validation Request
    • 4.3.2.   Handling a Received Validation Request
    • 4.3.3.   Handling a Validation Response
    • 4.3.4.   Freshening Stored Responses upon Validation
    • 4.3.5.   Freshening Responses via HEAD
  • 4.4.   Invalidation
• 5.   Header Field Definitions
  • 5.1.   Age
  • 5.2.   Cache-Control
    • 5.2.1.   Request Cache-Control Directives
    • 5.2.2.   Response Cache-Control Directives
    • 5.2.3.   Cache Control Extensions
  • 5.3.   Expires
  • 5.4.   Pragma
  • 5.5.   Warning
    • 5.5.1.   Warning: 110 - "Response is Stale"
    • 5.5.2.   Warning: 111 - "Revalidation Failed"
    • 5.5.3.   Warning: 112 - "Disconnected Operation"
    • 5.5.4.   Warning: 113 - "Heuristic Expiration"
    • 5.5.5.   Warning: 199 - "Miscellaneous Warning"
    • 5.5.6.   Warning: 214 - "Transformation Applied"
    • 5.5.7.   Warning: 299 - "Miscellaneous Persistent Warning"
• 6.   History Lists
• 7.   IANA Considerations
  • 7.1.   Cache Directive Registry
    • 7.1.1.   Procedure
    • 7.1.2.   Considerations for New Cache Control Directives
    • 7.1.3.   Registrations
  • 7.2.   Warn Code Registry
    • 7.2.1.   Procedure
    • 7.2.2.   Registrations
  • 7.3.   Header Field Registration
• 8.   Security Considerations
• 9.   References
  • 9.1.   Normative References
  • 9.2.   Informative References
• A.   Changes from RFC 7234
• B.   Imported ABNF
• C.   Collected ABNF
• D.   Change Log
  • D.1.   Since RFC 7234
• Acknowledgments
• Index
• Authors' Addresses

Hypertext Transfer Protocol (HTTP): Authentication

• 1.   Introduction
  • 1.1.   Conformance and Error Handling
  • 1.2.   Syntax Notation
• 2.   Access Authentication Framework
  • 2.1.   Challenge and Response
  • 2.2.   Protection Space (Realm)
• 3.   Status Code Definitions
  • 3.1.   401 Unauthorized
  • 3.2.   407 Proxy Authentication Required
• 4.   Header Field Definitions
  • 4.1.   WWW-Authenticate
  • 4.2.   Authorization
  • 4.3.   Proxy-Authenticate
  • 4.4.   Proxy-Authorization
• 5.   IANA Considerations
  • 5.1.   Authentication Scheme Registry
    • 5.1.1.   Procedure
    • 5.1.2.   Considerations for New Authentication Schemes
  • 5.2.   Status Code Registration
  • 5.3.   Header Field Registration
• 6.   Security Considerations
  • 6.1.   Confidentiality of Credentials
  • 6.2.   Authentication Credentials and Idle Clients
  • 6.3.   Protection Spaces
• 7.   References
  • 7.1.   Normative References
  • 7.2.   Informative References
• A.   Changes from RFC 7235
• B.   Imported ABNF
• C.   Collected ABNF
• D.   Change Log
  • D.1.   Since RFC 7235
• Acknowledgments
• Index
• Authors' Addresses