| draft-ietf-httpbis-p3-payload-02.txt | draft-ietf-httpbis-p3-payload-03.txt | |||
|---|---|---|---|---|
| Network Working Group R. Fielding, Ed. | Network Working Group R. Fielding, Ed. | |||
| Internet-Draft Day Software | Internet-Draft Day Software | |||
| Obsoletes: 2616 (if approved) J. Gettys | Obsoletes: 2616 (if approved) J. Gettys | |||
| Intended status: Standards Track One Laptop per Child | Intended status: Standards Track One Laptop per Child | |||
| Expires: August 27, 2008 J. Mogul | Expires: December 19, 2008 J. Mogul | |||
| HP | HP | |||
| H. Frystyk | H. Frystyk | |||
| Microsoft | Microsoft | |||
| L. Masinter | L. Masinter | |||
| Adobe Systems | Adobe Systems | |||
| P. Leach | P. Leach | |||
| Microsoft | Microsoft | |||
| T. Berners-Lee | T. Berners-Lee | |||
| W3C/MIT | W3C/MIT | |||
| Y. Lafon, Ed. | Y. Lafon, Ed. | |||
| W3C | W3C | |||
| J. Reschke, Ed. | J. Reschke, Ed. | |||
| greenbytes | greenbytes | |||
| February 24, 2008 | June 17, 2008 | |||
| HTTP/1.1, part 3: Message Payload and Content Negotiation | HTTP/1.1, part 3: Message Payload and Content Negotiation | |||
| draft-ietf-httpbis-p3-payload-02 | draft-ietf-httpbis-p3-payload-03 | |||
| Status of this Memo | Status of this Memo | |||
| By submitting this Internet-Draft, each author represents that any | By submitting this Internet-Draft, each author represents that any | |||
| applicable patent or other IPR claims of which he or she is aware | applicable patent or other IPR claims of which he or she is aware | |||
| have been or will be disclosed, and any of which he or she becomes | have been or will be disclosed, and any of which he or she becomes | |||
| aware will be disclosed, in accordance with Section 6 of BCP 79. | aware will be disclosed, in accordance with Section 6 of BCP 79. | |||
| Internet-Drafts are working documents of the Internet Engineering | Internet-Drafts are working documents of the Internet Engineering | |||
| Task Force (IETF), its areas, and its working groups. Note that | Task Force (IETF), its areas, and its working groups. Note that | |||
| skipping to change at page 1, line 49 | skipping to change at page 1, line 49 | |||
| and may be updated, replaced, or obsoleted by other documents at any | and may be updated, replaced, or obsoleted by other documents at any | |||
| time. It is inappropriate to use Internet-Drafts as reference | time. It is inappropriate to use Internet-Drafts as reference | |||
| material or to cite them other than as "work in progress." | material or to cite them other than as "work in progress." | |||
| The list of current Internet-Drafts can be accessed at | The list of current Internet-Drafts can be accessed at | |||
| http://www.ietf.org/ietf/1id-abstracts.txt. | http://www.ietf.org/ietf/1id-abstracts.txt. | |||
| The list of Internet-Draft Shadow Directories can be accessed at | The list of Internet-Draft Shadow Directories can be accessed at | |||
| http://www.ietf.org/shadow.html. | http://www.ietf.org/shadow.html. | |||
| This Internet-Draft will expire on August 27, 2008. | This Internet-Draft will expire on December 19, 2008. | |||
| Copyright Notice | ||||
| Copyright (C) The IETF Trust (2008). | ||||
| Abstract | Abstract | |||
| The Hypertext Transfer Protocol (HTTP) is an application-level | The Hypertext Transfer Protocol (HTTP) is an application-level | |||
| protocol for distributed, collaborative, hypermedia information | protocol for distributed, collaborative, hypermedia information | |||
| systems. HTTP has been in use by the World Wide Web global | systems. HTTP has been in use by the World Wide Web global | |||
| information initiative since 1990. This document is Part 3 of the | information initiative since 1990. This document is Part 3 of the | |||
| seven-part specification that defines the protocol referred to as | seven-part specification that defines the protocol referred to as | |||
| "HTTP/1.1" and, taken together, obsoletes RFC 2616. Part 3 defines | "HTTP/1.1" and, taken together, obsoletes RFC 2616. Part 3 defines | |||
| HTTP message content, metadata, and content negotiation. | HTTP message content, metadata, and content negotiation. | |||
| Editorial Note (To be removed by RFC Editor) | Editorial Note (To be removed by RFC Editor) | |||
| Discussion of this draft should take place on the HTTPBIS working | Discussion of this draft should take place on the HTTPBIS working | |||
| group mailing list (ietf-http-wg@w3.org). The current issues list is | group mailing list (ietf-http-wg@w3.org). The current issues list is | |||
| at <http://www.tools.ietf.org/wg/httpbis/trac/report/11> and related | at <http://www.tools.ietf.org/wg/httpbis/trac/report/11> and related | |||
| documents (including fancy diffs) can be found at | documents (including fancy diffs) can be found at | |||
| <http://www.tools.ietf.org/wg/httpbis/>. | <http://www.tools.ietf.org/wg/httpbis/>. | |||
| This draft incorporates those issue resolutions that were either | The changes in this draft are summarized in Appendix D.4. | |||
| collected in the original RFC2616 errata list | ||||
| (<http://purl.org/NET/http-errata>), or which were agreed upon on the | ||||
| mailing list between October 2006 and November 2007 (as published in | ||||
| "draft-lafon-rfc2616bis-03"). | ||||
| Table of Contents | Table of Contents | |||
| 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 5 | 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 5 | |||
| 1.1. Requirements . . . . . . . . . . . . . . . . . . . . . . . 5 | 1.1. Requirements . . . . . . . . . . . . . . . . . . . . . . . 5 | |||
| 2. Notational Conventions and Generic Grammar . . . . . . . . . . 5 | 2. Notational Conventions and Generic Grammar . . . . . . . . . . 5 | |||
| 3. Protocol Parameters . . . . . . . . . . . . . . . . . . . . . 6 | 3. Protocol Parameters . . . . . . . . . . . . . . . . . . . . . 6 | |||
| 3.1. Character Sets . . . . . . . . . . . . . . . . . . . . . . 6 | 3.1. Character Sets . . . . . . . . . . . . . . . . . . . . . . 6 | |||
| 3.1.1. Missing Charset . . . . . . . . . . . . . . . . . . . 7 | 3.1.1. Missing Charset . . . . . . . . . . . . . . . . . . . 7 | |||
| 3.2. Content Codings . . . . . . . . . . . . . . . . . . . . . 7 | 3.2. Content Codings . . . . . . . . . . . . . . . . . . . . . 7 | |||
| 3.3. Media Types . . . . . . . . . . . . . . . . . . . . . . . 9 | 3.3. Media Types . . . . . . . . . . . . . . . . . . . . . . . 8 | |||
| 3.3.1. Canonicalization and Text Defaults . . . . . . . . . . 9 | 3.3.1. Canonicalization and Text Defaults . . . . . . . . . . 9 | |||
| 3.3.2. Multipart Types . . . . . . . . . . . . . . . . . . . 10 | 3.3.2. Multipart Types . . . . . . . . . . . . . . . . . . . 10 | |||
| 3.4. Quality Values . . . . . . . . . . . . . . . . . . . . . . 11 | 3.4. Quality Values . . . . . . . . . . . . . . . . . . . . . . 11 | |||
| 3.5. Language Tags . . . . . . . . . . . . . . . . . . . . . . 11 | 3.5. Language Tags . . . . . . . . . . . . . . . . . . . . . . 11 | |||
| 4. Entity . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 | 4. Entity . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 | |||
| 4.1. Entity Header Fields . . . . . . . . . . . . . . . . . . . 12 | 4.1. Entity Header Fields . . . . . . . . . . . . . . . . . . . 12 | |||
| 4.2. Entity Body . . . . . . . . . . . . . . . . . . . . . . . 12 | 4.2. Entity Body . . . . . . . . . . . . . . . . . . . . . . . 12 | |||
| 4.2.1. Type . . . . . . . . . . . . . . . . . . . . . . . . . 13 | 4.2.1. Type . . . . . . . . . . . . . . . . . . . . . . . . . 13 | |||
| 4.2.2. Entity Length . . . . . . . . . . . . . . . . . . . . 13 | 4.2.2. Entity Length . . . . . . . . . . . . . . . . . . . . 13 | |||
| 5. Content Negotiation . . . . . . . . . . . . . . . . . . . . . 13 | 5. Content Negotiation . . . . . . . . . . . . . . . . . . . . . 13 | |||
| skipping to change at page 3, line 39 | skipping to change at page 3, line 39 | |||
| 6.1. Accept . . . . . . . . . . . . . . . . . . . . . . . . . . 16 | 6.1. Accept . . . . . . . . . . . . . . . . . . . . . . . . . . 16 | |||
| 6.2. Accept-Charset . . . . . . . . . . . . . . . . . . . . . . 18 | 6.2. Accept-Charset . . . . . . . . . . . . . . . . . . . . . . 18 | |||
| 6.3. Accept-Encoding . . . . . . . . . . . . . . . . . . . . . 19 | 6.3. Accept-Encoding . . . . . . . . . . . . . . . . . . . . . 19 | |||
| 6.4. Accept-Language . . . . . . . . . . . . . . . . . . . . . 20 | 6.4. Accept-Language . . . . . . . . . . . . . . . . . . . . . 20 | |||
| 6.5. Content-Encoding . . . . . . . . . . . . . . . . . . . . . 22 | 6.5. Content-Encoding . . . . . . . . . . . . . . . . . . . . . 22 | |||
| 6.6. Content-Language . . . . . . . . . . . . . . . . . . . . . 22 | 6.6. Content-Language . . . . . . . . . . . . . . . . . . . . . 22 | |||
| 6.7. Content-Location . . . . . . . . . . . . . . . . . . . . . 23 | 6.7. Content-Location . . . . . . . . . . . . . . . . . . . . . 23 | |||
| 6.8. Content-MD5 . . . . . . . . . . . . . . . . . . . . . . . 24 | 6.8. Content-MD5 . . . . . . . . . . . . . . . . . . . . . . . 24 | |||
| 6.9. Content-Type . . . . . . . . . . . . . . . . . . . . . . . 25 | 6.9. Content-Type . . . . . . . . . . . . . . . . . . . . . . . 25 | |||
| 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 26 | 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 26 | |||
| 7.1. Message Header Registration . . . . . . . . . . . . . . . 26 | ||||
| 8. Security Considerations . . . . . . . . . . . . . . . . . . . 26 | 8. Security Considerations . . . . . . . . . . . . . . . . . . . 26 | |||
| 8.1. Privacy Issues Connected to Accept Headers . . . . . . . . 26 | 8.1. Privacy Issues Connected to Accept Headers . . . . . . . . 26 | |||
| 8.2. Content-Disposition Issues . . . . . . . . . . . . . . . . 27 | 8.2. Content-Disposition Issues . . . . . . . . . . . . . . . . 27 | |||
| 9. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 27 | 9. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 27 | |||
| 10. References . . . . . . . . . . . . . . . . . . . . . . . . . . 27 | 10. References . . . . . . . . . . . . . . . . . . . . . . . . . . 27 | |||
| 10.1. Normative References . . . . . . . . . . . . . . . . . . . 27 | 10.1. Normative References . . . . . . . . . . . . . . . . . . . 27 | |||
| 10.2. Informative References . . . . . . . . . . . . . . . . . . 29 | 10.2. Informative References . . . . . . . . . . . . . . . . . . 29 | |||
| Appendix A. Differences Between HTTP Entities and RFC 2045 | Appendix A. Differences Between HTTP Entities and RFC 2045 | |||
| Entities . . . . . . . . . . . . . . . . . . . . . . 30 | Entities . . . . . . . . . . . . . . . . . . . . . . 30 | |||
| A.1. MIME-Version . . . . . . . . . . . . . . . . . . . . . . . 30 | A.1. MIME-Version . . . . . . . . . . . . . . . . . . . . . . . 31 | |||
| A.2. Conversion to Canonical Form . . . . . . . . . . . . . . . 30 | A.2. Conversion to Canonical Form . . . . . . . . . . . . . . . 31 | |||
| A.3. Introduction of Content-Encoding . . . . . . . . . . . . . 31 | A.3. Introduction of Content-Encoding . . . . . . . . . . . . . 31 | |||
| A.4. No Content-Transfer-Encoding . . . . . . . . . . . . . . . 31 | A.4. No Content-Transfer-Encoding . . . . . . . . . . . . . . . 32 | |||
| A.5. Introduction of Transfer-Encoding . . . . . . . . . . . . 31 | A.5. Introduction of Transfer-Encoding . . . . . . . . . . . . 32 | |||
| A.6. MHTML and Line Length Limitations . . . . . . . . . . . . 32 | A.6. MHTML and Line Length Limitations . . . . . . . . . . . . 32 | |||
| Appendix B. Additional Features . . . . . . . . . . . . . . . . . 32 | Appendix B. Additional Features . . . . . . . . . . . . . . . . . 32 | |||
| B.1. Content-Disposition . . . . . . . . . . . . . . . . . . . 32 | B.1. Content-Disposition . . . . . . . . . . . . . . . . . . . 33 | |||
| Appendix C. Compatibility with Previous Versions . . . . . . . . 33 | Appendix C. Compatibility with Previous Versions . . . . . . . . 33 | |||
| C.1. Changes from RFC 2068 . . . . . . . . . . . . . . . . . . 33 | C.1. Changes from RFC 2068 . . . . . . . . . . . . . . . . . . 33 | |||
| C.2. Changes from RFC 2616 . . . . . . . . . . . . . . . . . . 33 | C.2. Changes from RFC 2616 . . . . . . . . . . . . . . . . . . 34 | |||
| Appendix D. Change Log (to be removed by RFC Editor before | Appendix D. Change Log (to be removed by RFC Editor before | |||
| publication) . . . . . . . . . . . . . . . . . . . . 34 | publication) . . . . . . . . . . . . . . . . . . . . 34 | |||
| D.1. Since RFC2616 . . . . . . . . . . . . . . . . . . . . . . 34 | D.1. Since RFC2616 . . . . . . . . . . . . . . . . . . . . . . 34 | |||
| D.2. Since draft-ietf-httpbis-p3-payload-00 . . . . . . . . . . 34 | D.2. Since draft-ietf-httpbis-p3-payload-00 . . . . . . . . . . 34 | |||
| D.3. Since draft-ietf-httpbis-p3-payload-01 . . . . . . . . . . 35 | D.3. Since draft-ietf-httpbis-p3-payload-01 . . . . . . . . . . 35 | |||
| Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 | D.4. Since draft-ietf-httpbis-p3-payload-02 . . . . . . . . . . 35 | |||
| Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 37 | Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 | |||
| Intellectual Property and Copyright Statements . . . . . . . . . . 40 | Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 38 | |||
| Intellectual Property and Copyright Statements . . . . . . . . . . 41 | ||||
| 1. Introduction | 1. Introduction | |||
| This document defines HTTP/1.1 message payloads (a.k.a., content), | This document defines HTTP/1.1 message payloads (a.k.a., content), | |||
| the associated metadata header fields that define how the payload is | the associated metadata header fields that define how the payload is | |||
| intended to be interpreted by a recipient, the request header fields | intended to be interpreted by a recipient, the request header fields | |||
| that may influence content selection, and the various selection | that may influence content selection, and the various selection | |||
| algorithms that are collectively referred to as HTTP content | algorithms that are collectively referred to as HTTP content | |||
| negotiation. | negotiation. | |||
| skipping to change at page 6, line 13 | skipping to change at page 6, line 13 | |||
| quoted-string = <quoted-string, defined in [Part1], Section 2.2> | quoted-string = <quoted-string, defined in [Part1], Section 2.2> | |||
| token = <token, defined in [Part1], Section 2.2> | token = <token, defined in [Part1], Section 2.2> | |||
| The ABNF rules below are defined in other parts: | The ABNF rules below are defined in other parts: | |||
| absoluteURI = <absoluteURI, defined in [Part1], Section 3.2.1> | absoluteURI = <absoluteURI, defined in [Part1], Section 3.2.1> | |||
| Content-Length = <Content-Length, defined in [Part1], Section 8.2> | Content-Length = <Content-Length, defined in [Part1], Section 8.2> | |||
| relativeURI = <relativeURI, defined in [Part1], Section 3.2.1> | relativeURI = <relativeURI, defined in [Part1], Section 3.2.1> | |||
| message-header = <message-header, defined in [Part1], Section 4.2> | message-header = <message-header, defined in [Part1], Section 4.2> | |||
| Allow = <Allow, defined in [Part2], Section 10.1> | ||||
| Last-Modified = <Last-Modified, defined in [Part4], Section 7.6> | Last-Modified = <Last-Modified, defined in [Part4], Section 7.6> | |||
| Content-Range = <Content-Range, defined in [Part5], Section 6.2> | Content-Range = <Content-Range, defined in [Part5], Section 6.2> | |||
| Expires = <Expires, defined in [Part6], Section 16.3> | Expires = <Expires, defined in [Part6], Section 16.3> | |||
| 3. Protocol Parameters | 3. Protocol Parameters | |||
| 3.1. Character Sets | 3.1. Character Sets | |||
| skipping to change at page 9, line 30 | skipping to change at page 9, line 25 | |||
| value = token | quoted-string | value = token | quoted-string | |||
| The type, subtype, and parameter attribute names are case- | The type, subtype, and parameter attribute names are case- | |||
| insensitive. Parameter values might or might not be case-sensitive, | insensitive. Parameter values might or might not be case-sensitive, | |||
| depending on the semantics of the parameter name. Linear white space | depending on the semantics of the parameter name. Linear white space | |||
| (LWS) MUST NOT be used between the type and subtype, nor between an | (LWS) MUST NOT be used between the type and subtype, nor between an | |||
| attribute and its value. The presence or absence of a parameter | attribute and its value. The presence or absence of a parameter | |||
| might be significant to the processing of a media-type, depending on | might be significant to the processing of a media-type, depending on | |||
| its definition within the media type registry. | its definition within the media type registry. | |||
| All parameters defined as a token are also allowed to occur as | ||||
| quoted-string; both notations are equivalent. | ||||
| Note that some older HTTP applications do not recognize media type | Note that some older HTTP applications do not recognize media type | |||
| parameters. When sending data to older HTTP applications, | parameters. When sending data to older HTTP applications, | |||
| implementations SHOULD only use media type parameters when they are | implementations SHOULD only use media type parameters when they are | |||
| required by that type/subtype definition. | required by that type/subtype definition. | |||
| Media-type values are registered with the Internet Assigned Number | Media-type values are registered with the Internet Assigned Number | |||
| Authority (IANA). The media type registration process is outlined in | Authority (IANA). The media type registration process is outlined in | |||
| [RFC4288]. Use of non-registered media types is discouraged. | [RFC4288]. Use of non-registered media types is discouraged. | |||
| 3.3.1. Canonicalization and Text Defaults | 3.3.1. Canonicalization and Text Defaults | |||
| skipping to change at page 12, line 21 | skipping to change at page 12, line 21 | |||
| responses will only include the entity-headers. | responses will only include the entity-headers. | |||
| In this section, both sender and recipient refer to either the client | In this section, both sender and recipient refer to either the client | |||
| or the server, depending on who sends and who receives the entity. | or the server, depending on who sends and who receives the entity. | |||
| 4.1. Entity Header Fields | 4.1. Entity Header Fields | |||
| Entity-header fields define metainformation about the entity-body or, | Entity-header fields define metainformation about the entity-body or, | |||
| if no body is present, about the resource identified by the request. | if no body is present, about the resource identified by the request. | |||
| entity-header = Allow ; [Part2], Section 10.1 | entity-header = Content-Encoding ; Section 6.5 | |||
| | Content-Encoding ; Section 6.5 | ||||
| | Content-Language ; Section 6.6 | | Content-Language ; Section 6.6 | |||
| | Content-Length ; [Part1], Section 8.2 | | Content-Length ; [Part1], Section 8.2 | |||
| | Content-Location ; Section 6.7 | | Content-Location ; Section 6.7 | |||
| | Content-MD5 ; Section 6.8 | | Content-MD5 ; Section 6.8 | |||
| | Content-Range ; [Part5], Section 6.2 | | Content-Range ; [Part5], Section 6.2 | |||
| | Content-Type ; Section 6.9 | | Content-Type ; Section 6.9 | |||
| | Expires ; [Part6], Section 16.3 | | Expires ; [Part6], Section 16.3 | |||
| | Last-Modified ; [Part4], Section 7.6 | | Last-Modified ; [Part4], Section 7.6 | |||
| | extension-header | | extension-header | |||
| skipping to change at page 19, line 28 | skipping to change at page 19, line 28 | |||
| 6.3. Accept-Encoding | 6.3. Accept-Encoding | |||
| The Accept-Encoding request-header field is similar to Accept, but | The Accept-Encoding request-header field is similar to Accept, but | |||
| restricts the content-codings (Section 3.2) that are acceptable in | restricts the content-codings (Section 3.2) that are acceptable in | |||
| the response. | the response. | |||
| Accept-Encoding = "Accept-Encoding" ":" | Accept-Encoding = "Accept-Encoding" ":" | |||
| #( codings [ ";" "q" "=" qvalue ] ) | #( codings [ ";" "q" "=" qvalue ] ) | |||
| codings = ( content-coding | "*" ) | codings = ( content-coding | "*" ) | |||
| Each codings value MAY be given an associated quality value which | ||||
| represents the preference for that encoding. The default value is | ||||
| q=1. | ||||
| Examples of its use are: | Examples of its use are: | |||
| Accept-Encoding: compress, gzip | Accept-Encoding: compress, gzip | |||
| Accept-Encoding: | Accept-Encoding: | |||
| Accept-Encoding: * | Accept-Encoding: * | |||
| Accept-Encoding: compress;q=0.5, gzip;q=1.0 | Accept-Encoding: compress;q=0.5, gzip;q=1.0 | |||
| Accept-Encoding: gzip;q=1.0, identity; q=0.5, *;q=0 | Accept-Encoding: gzip;q=1.0, identity; q=0.5, *;q=0 | |||
| A server tests whether a content-coding is acceptable, according to | A server tests whether a content-coding is acceptable, according to | |||
| an Accept-Encoding field, using these rules: | an Accept-Encoding field, using these rules: | |||
| skipping to change at page 26, line 7 | skipping to change at page 26, line 7 | |||
| Media types are defined in Section 3.3. An example of the field is | Media types are defined in Section 3.3. An example of the field is | |||
| Content-Type: text/html; charset=ISO-8859-4 | Content-Type: text/html; charset=ISO-8859-4 | |||
| Further discussion of methods for identifying the media type of an | Further discussion of methods for identifying the media type of an | |||
| entity is provided in Section 4.2.1. | entity is provided in Section 4.2.1. | |||
| 7. IANA Considerations | 7. IANA Considerations | |||
| [[anchor1: TBD.]] | 7.1. Message Header Registration | |||
| The Message Header Registry located at <http://www.iana.org/ | ||||
| assignments/message-headers/message-header-index.html> should be | ||||
| updated with the permanent registrations below (see [RFC3864]): | ||||
| +---------------------+----------+----------+--------------+ | ||||
| | Header Field Name | Protocol | Status | Reference | | ||||
| +---------------------+----------+----------+--------------+ | ||||
| | Accept | http | standard | Section 6.1 | | ||||
| | Accept-Charset | http | standard | Section 6.2 | | ||||
| | Accept-Encoding | http | standard | Section 6.3 | | ||||
| | Accept-Language | http | standard | Section 6.4 | | ||||
| | Content-Disposition | http | | Appendix B.1 | | ||||
| | Content-Encoding | http | standard | Section 6.5 | | ||||
| | Content-Language | http | standard | Section 6.6 | | ||||
| | Content-Location | http | standard | Section 6.7 | | ||||
| | Content-MD5 | http | standard | Section 6.8 | | ||||
| | Content-Type | http | standard | Section 6.9 | | ||||
| +---------------------+----------+----------+--------------+ | ||||
| The change controller is: "IETF (iesg@ietf.org) - Internet | ||||
| Engineering Task Force". | ||||
| 8. Security Considerations | 8. Security Considerations | |||
| This section is meant to inform application developers, information | This section is meant to inform application developers, information | |||
| providers, and users of the security limitations in HTTP/1.1 as | providers, and users of the security limitations in HTTP/1.1 as | |||
| described by this document. The discussion does not include | described by this document. The discussion does not include | |||
| definitive solutions to the problems revealed, though it does make | definitive solutions to the problems revealed, though it does make | |||
| some suggestions for reducing security risks. | some suggestions for reducing security risks. | |||
| 8.1. Privacy Issues Connected to Accept Headers | 8.1. Privacy Issues Connected to Accept Headers | |||
| skipping to change at page 27, line 29 | skipping to change at page 28, line 4 | |||
| [ISO-8859-1] | [ISO-8859-1] | |||
| International Organization for Standardization, | International Organization for Standardization, | |||
| "Information technology -- 8-bit single-byte coded graphic | "Information technology -- 8-bit single-byte coded graphic | |||
| character sets -- Part 1: Latin alphabet No. 1", ISO/ | character sets -- Part 1: Latin alphabet No. 1", ISO/ | |||
| IEC 8859-1:1998, 1998. | IEC 8859-1:1998, 1998. | |||
| [Part1] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., | [Part1] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., | |||
| Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., | Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., | |||
| and J. Reschke, Ed., "HTTP/1.1, part 1: URIs, Connections, | and J. Reschke, Ed., "HTTP/1.1, part 1: URIs, Connections, | |||
| and Message Parsing", draft-ietf-httpbis-p1-messaging-02 | and Message Parsing", draft-ietf-httpbis-p1-messaging-03 | |||
| (work in progress), February 2008. | (work in progress), June 2008. | |||
| [Part2] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., | [Part2] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., | |||
| Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., | Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., | |||
| and J. Reschke, Ed., "HTTP/1.1, part 2: Message | and J. Reschke, Ed., "HTTP/1.1, part 2: Message | |||
| Semantics", draft-ietf-httpbis-p2-semantics-02 (work in | Semantics", draft-ietf-httpbis-p2-semantics-03 (work in | |||
| progress), February 2008. | progress), June 2008. | |||
| [Part4] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., | [Part4] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., | |||
| Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., | Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., | |||
| and J. Reschke, Ed., "HTTP/1.1, part 4: Conditional | and J. Reschke, Ed., "HTTP/1.1, part 4: Conditional | |||
| Requests", draft-ietf-httpbis-p4-conditional-02 (work in | Requests", draft-ietf-httpbis-p4-conditional-03 (work in | |||
| progress), February 2008. | progress), June 2008. | |||
| [Part5] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., | [Part5] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., | |||
| Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., | Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., | |||
| and J. Reschke, Ed., "HTTP/1.1, part 5: Range Requests and | and J. Reschke, Ed., "HTTP/1.1, part 5: Range Requests and | |||
| Partial Responses", draft-ietf-httpbis-p5-range-02 (work | Partial Responses", draft-ietf-httpbis-p5-range-03 (work | |||
| in progress), February 2008. | in progress), June 2008. | |||
| [Part6] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., | [Part6] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., | |||
| Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., | Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., | |||
| and J. Reschke, Ed., "HTTP/1.1, part 6: Caching", | and J. Reschke, Ed., "HTTP/1.1, part 6: Caching", | |||
| draft-ietf-httpbis-p6-cache-02 (work in progress), | draft-ietf-httpbis-p6-cache-03 (work in progress), | |||
| February 2008. | June 2008. | |||
| [RFC1766] Alvestrand, H., "Tags for the Identification of | [RFC1766] Alvestrand, H., "Tags for the Identification of | |||
| Languages", RFC 1766, March 1995. | Languages", RFC 1766, March 1995. | |||
| [RFC1864] Myers, J. and M. Rose, "The Content-MD5 Header Field", | [RFC1864] Myers, J. and M. Rose, "The Content-MD5 Header Field", | |||
| RFC 1864, October 1995. | RFC 1864, October 1995. | |||
| [RFC1950] Deutsch, L. and J-L. Gailly, "ZLIB Compressed Data Format | [RFC1950] Deutsch, L. and J-L. Gailly, "ZLIB Compressed Data Format | |||
| Specification version 3.3", RFC 1950, May 1996. | Specification version 3.3", RFC 1950, May 1996. | |||
| skipping to change at page 29, line 50 | skipping to change at page 30, line 25 | |||
| [RFC2616] Fielding, R., Gettys, J., Mogul, J., Frystyk, H., | [RFC2616] Fielding, R., Gettys, J., Mogul, J., Frystyk, H., | |||
| Masinter, L., Leach, P., and T. Berners-Lee, "Hypertext | Masinter, L., Leach, P., and T. Berners-Lee, "Hypertext | |||
| Transfer Protocol -- HTTP/1.1", RFC 2616, June 1999. | Transfer Protocol -- HTTP/1.1", RFC 2616, June 1999. | |||
| [RFC2822] Resnick, P., "Internet Message Format", RFC 2822, | [RFC2822] Resnick, P., "Internet Message Format", RFC 2822, | |||
| April 2001. | April 2001. | |||
| [RFC3629] Yergeau, F., "UTF-8, a transformation format of ISO | [RFC3629] Yergeau, F., "UTF-8, a transformation format of ISO | |||
| 10646", RFC 3629, STD 63, November 2003. | 10646", RFC 3629, STD 63, November 2003. | |||
| [RFC3864] Klyne, G., Nottingham, M., and J. Mogul, "Registration | ||||
| Procedures for Message Header Fields", BCP 90, RFC 3864, | ||||
| September 2004. | ||||
| [RFC4288] Freed, N. and J. Klensin, "Media Type Specifications and | [RFC4288] Freed, N. and J. Klensin, "Media Type Specifications and | |||
| Registration Procedures", BCP 13, RFC 4288, December 2005. | Registration Procedures", BCP 13, RFC 4288, December 2005. | |||
| Appendix A. Differences Between HTTP Entities and RFC 2045 Entities | Appendix A. Differences Between HTTP Entities and RFC 2045 Entities | |||
| HTTP/1.1 uses many of the constructs defined for Internet Mail | HTTP/1.1 uses many of the constructs defined for Internet Mail | |||
| ([RFC2822]) and the Multipurpose Internet Mail Extensions (MIME | ([RFC2822]) and the Multipurpose Internet Mail Extensions (MIME | |||
| [RFC2045]) to allow entities to be transmitted in an open variety of | [RFC2045]) to allow entities to be transmitted in an open variety of | |||
| representations and with extensible mechanisms. However, RFC 2045 | representations and with extensible mechanisms. However, RFC 2045 | |||
| discusses mail, and HTTP has a few features that are different from | discusses mail, and HTTP has a few features that are different from | |||
| skipping to change at page 35, line 13 | skipping to change at page 35, line 33 | |||
| up-to-date references" | up-to-date references" | |||
| D.3. Since draft-ietf-httpbis-p3-payload-01 | D.3. Since draft-ietf-httpbis-p3-payload-01 | |||
| Ongoing work on ABNF conversion | Ongoing work on ABNF conversion | |||
| (<http://www3.tools.ietf.org/wg/httpbis/trac/ticket/36>): | (<http://www3.tools.ietf.org/wg/httpbis/trac/ticket/36>): | |||
| o Add explicit references to BNF syntax and rules imported from | o Add explicit references to BNF syntax and rules imported from | |||
| other parts of the specification. | other parts of the specification. | |||
| D.4. Since draft-ietf-httpbis-p3-payload-02 | ||||
| Closed issues: | ||||
| o <http://www3.tools.ietf.org/wg/httpbis/trac/ticket/67>: "Quoting | ||||
| Charsets" | ||||
| o <http://www3.tools.ietf.org/wg/httpbis/trac/ticket/105>: | ||||
| "Classification for Allow header" | ||||
| o <http://www3.tools.ietf.org/wg/httpbis/trac/ticket/115>: "missing | ||||
| default for qvalue in description of Accept-Encoding" | ||||
| Ongoing work on IANA Message Header Registration | ||||
| (<http://www3.tools.ietf.org/wg/httpbis/trac/ticket/40>): | ||||
| o Reference RFC 3984, and update header registrations for headers | ||||
| defined in this document. | ||||
| Index | Index | |||
| A | A | |||
| Accept header 16 | Accept header 16 | |||
| Accept-Charset header 18 | Accept-Charset header 18 | |||
| Accept-Encoding header 19 | Accept-Encoding header 19 | |||
| Accept-Language header 20 | Accept-Language header 20 | |||
| Alternates header 33 | Alternates header 34 | |||
| C | C | |||
| compress 8 | compress 8 | |||
| Content-Base header 33 | Content-Base header 34 | |||
| Content-Disposition header 32 | Content-Disposition header 33 | |||
| Content-Encoding header 22 | Content-Encoding header 22 | |||
| Content-Language header 22 | Content-Language header 22 | |||
| Content-Location header 23 | Content-Location header 23 | |||
| Content-MD5 header 24 | Content-MD5 header 24 | |||
| Content-Type header 25 | Content-Type header 25 | |||
| Content-Version header 33 | Content-Version header 34 | |||
| D | D | |||
| deflate 8 | deflate 8 | |||
| Derived-From header 33 | Derived-From header 34 | |||
| G | G | |||
| Grammar | Grammar | |||
| Accept 16 | Accept 16 | |||
| Accept-Charset 18 | Accept-Charset 18 | |||
| Accept-Encoding 19 | Accept-Encoding 19 | |||
| accept-extension 16 | accept-extension 16 | |||
| Accept-Language 20 | Accept-Language 20 | |||
| accept-params 16 | accept-params 16 | |||
| attribute 9 | attribute 9 | |||
| charset 7 | charset 7 | |||
| codings 19 | codings 19 | |||
| content-coding 7 | content-coding 7 | |||
| content-disposition 32 | content-disposition 33 | |||
| Content-Encoding 22 | Content-Encoding 22 | |||
| Content-Language 22 | Content-Language 22 | |||
| Content-Location 23 | Content-Location 23 | |||
| Content-MD5 24 | Content-MD5 24 | |||
| Content-Type 25 | Content-Type 25 | |||
| disp-extension-parm 32 | disp-extension-parm 33 | |||
| disp-extension-token 32 | disp-extension-token 33 | |||
| disposition-parm 32 | disposition-parm 33 | |||
| disposition-type 32 | disposition-type 33 | |||
| entity-body 12 | entity-body 12 | |||
| entity-header 12 | entity-header 12 | |||
| extension-header 12 | extension-header 12 | |||
| filename-parm 32 | filename-parm 33 | |||
| language-range 20 | language-range 20 | |||
| language-tag 11 | language-tag 11 | |||
| md5-digest 24 | md5-digest 24 | |||
| media-range 16 | media-range 16 | |||
| media-type 9 | media-type 9 | |||
| MIME-Version 30 | MIME-Version 31 | |||
| parameter 9 | parameter 9 | |||
| primary-tag 11 | primary-tag 11 | |||
| qvalue 11 | qvalue 11 | |||
| subtag 11 | subtag 11 | |||
| subtype 9 | subtype 9 | |||
| type 9 | type 9 | |||
| value 9 | value 9 | |||
| gzip 8 | gzip 8 | |||
| H | H | |||
| Headers | Headers | |||
| Accept 16 | Accept 16 | |||
| Accept-Charset 18 | Accept-Charset 18 | |||
| Accept-Encoding 19 | Accept-Encoding 19 | |||
| Accept-Language 20 | Accept-Language 20 | |||
| Alternate 33 | Alternate 34 | |||
| Content-Base 33 | Content-Base 34 | |||
| Content-Disposition 32 | Content-Disposition 33 | |||
| Content-Encoding 22 | Content-Encoding 22 | |||
| Content-Language 22 | Content-Language 22 | |||
| Content-Location 23 | Content-Location 23 | |||
| Content-MD5 24 | Content-MD5 24 | |||
| Content-Type 25 | Content-Type 25 | |||
| Content-Version 33 | Content-Version 34 | |||
| Derived-From 33 | Derived-From 34 | |||
| Link 33 | Link 34 | |||
| Public 33 | Public 34 | |||
| URI 33 | URI 34 | |||
| I | I | |||
| identity 8 | identity 8 | |||
| L | L | |||
| Link header 33 | Link header 34 | |||
| P | P | |||
| Public header 33 | Public header 34 | |||
| U | U | |||
| URI header 33 | URI header 34 | |||
| Authors' Addresses | Authors' Addresses | |||
| Roy T. Fielding (editor) | Roy T. Fielding (editor) | |||
| Day Software | Day Software | |||
| 23 Corporate Plaza DR, Suite 280 | 23 Corporate Plaza DR, Suite 280 | |||
| Newport Beach, CA 92660 | Newport Beach, CA 92660 | |||
| USA | USA | |||
| Phone: +1-949-706-5300 | Phone: +1-949-706-5300 | |||
| skipping to change at page 40, line 44 | skipping to change at line 1822 | |||
| attempt made to obtain a general license or permission for the use of | attempt made to obtain a general license or permission for the use of | |||
| such proprietary rights by implementers or users of this | such proprietary rights by implementers or users of this | |||
| specification can be obtained from the IETF on-line IPR repository at | specification can be obtained from the IETF on-line IPR repository at | |||
| http://www.ietf.org/ipr. | http://www.ietf.org/ipr. | |||
| The IETF invites any interested party to bring to its attention any | The IETF invites any interested party to bring to its attention any | |||
| copyrights, patents or patent applications, or other proprietary | copyrights, patents or patent applications, or other proprietary | |||
| rights that may cover technology that may be required to implement | rights that may cover technology that may be required to implement | |||
| this standard. Please address the information to the IETF at | this standard. Please address the information to the IETF at | |||
| ietf-ipr@ietf.org. | ietf-ipr@ietf.org. | |||
| Acknowledgment | ||||
| Funding for the RFC Editor function is provided by the IETF | ||||
| Administrative Support Activity (IASA). | ||||
| End of changes. 39 change blocks. | ||||
| 61 lines changed or deleted | 105 lines changed or added | |||
This html diff was produced by rfcdiff 1.34. The latest version is available from http://tools.ietf.org/tools/rfcdiff/ | ||||