| draft-ietf-httpbis-p3-payload-02.txt |  | draft-ietf-httpbis-p3-payload-03.txt |
--- | --- | --- | --- | ---
| Network Working Group R. Fielding, Ed. |  | Network Working Group R. Fielding, Ed. |
| Internet-Draft Day Software |  | Internet-Draft Day Software |
| Obsoletes: 2616 (if approved) J. Gettys |  | Obsoletes: 2616 (if approved) J. Gettys |
| Intended status: Standards Track One Laptop per Child |  | Intended status: Standards Track One Laptop per Child |
| Expires: August 27, 2008 J. Mogul |  | Expires: December 19, 2008 J. Mogul |
| HP |  | HP |
| H. Frystyk |  | H. Frystyk |
| Microsoft |  | Microsoft |
| L. Masinter |  | L. Masinter |
| Adobe Systems |  | Adobe Systems |
| P. Leach |  | P. Leach |
| Microsoft |  | Microsoft |
| T. Berners-Lee |  | T. Berners-Lee |
| W3C/MIT |  | W3C/MIT |
| Y. Lafon, Ed. |  | Y. Lafon, Ed. |
| W3C |  | W3C |
| J. Reschke, Ed. |  | J. Reschke, Ed. |
| greenbytes |  | greenbytes |
| February 24, 2008 |  | June 17, 2008 |
| HTTP/1.1, part 3: Message Payload and Content Negotiation |  | HTTP/1.1, part 3: Message Payload and Content Negotiation |
| draft-ietf-httpbis-p3-payload-02 |  | draft-ietf-httpbis-p3-payload-03 |
| Status of this Memo |  | Status of this Memo |
| By submitting this Internet-Draft, each author represents that any |  | By submitting this Internet-Draft, each author represents that any |
| applicable patent or other IPR claims of which he or she is aware |  | applicable patent or other IPR claims of which he or she is aware |
| have been or will be disclosed, and any of which he or she becomes |  | have been or will be disclosed, and any of which he or she becomes |
| aware will be disclosed, in accordance with Section 6 of BCP 79. |  | aware will be disclosed, in accordance with Section 6 of BCP 79. |
| Internet-Drafts are working documents of the Internet Engineering |  | Internet-Drafts are working documents of the Internet Engineering |
| Task Force (IETF), its areas, and its working groups. Note that |  | Task Force (IETF), its areas, and its working groups. Note that |
| skipping to change at page 1, line 49 |  | skipping to change at page 1, line 49 |
| and may be updated, replaced, or obsoleted by other documents at any |  | and may be updated, replaced, or obsoleted by other documents at any |
| time. It is inappropriate to use Internet-Drafts as reference |  | time. It is inappropriate to use Internet-Drafts as reference |
| material or to cite them other than as "work in progress." |  | material or to cite them other than as "work in progress." |
| The list of current Internet-Drafts can be accessed at |  | The list of current Internet-Drafts can be accessed at |
| http://www.ietf.org/ietf/1id-abstracts.txt. |  | http://www.ietf.org/ietf/1id-abstracts.txt. |
| The list of Internet-Draft Shadow Directories can be accessed at |  | The list of Internet-Draft Shadow Directories can be accessed at |
| http://www.ietf.org/shadow.html. |  | http://www.ietf.org/shadow.html. |
| This Internet-Draft will expire on August 27, 2008. |  | This Internet-Draft will expire on December 19, 2008. |
| Copyright Notice |  |  |
| Copyright (C) The IETF Trust (2008). |  |  |
| Abstract |  | Abstract |
| The Hypertext Transfer Protocol (HTTP) is an application-level |  | The Hypertext Transfer Protocol (HTTP) is an application-level |
| protocol for distributed, collaborative, hypermedia information |  | protocol for distributed, collaborative, hypermedia information |
| systems. HTTP has been in use by the World Wide Web global |  | systems. HTTP has been in use by the World Wide Web global |
| information initiative since 1990. This document is Part 3 of the |  | information initiative since 1990. This document is Part 3 of the |
| seven-part specification that defines the protocol referred to as |  | seven-part specification that defines the protocol referred to as |
| "HTTP/1.1" and, taken together, obsoletes RFC 2616. Part 3 defines |  | "HTTP/1.1" and, taken together, obsoletes RFC 2616. Part 3 defines |
| HTTP message content, metadata, and content negotiation. |  | HTTP message content, metadata, and content negotiation. |
| Editorial Note (To be removed by RFC Editor) |  | Editorial Note (To be removed by RFC Editor) |
| Discussion of this draft should take place on the HTTPBIS working |  | Discussion of this draft should take place on the HTTPBIS working |
| group mailing list (ietf-http-wg@w3.org). The current issues list is |  | group mailing list (ietf-http-wg@w3.org). The current issues list is |
| at <http://www.tools.ietf.org/wg/httpbis/trac/report/11> and related |  | at <http://www.tools.ietf.org/wg/httpbis/trac/report/11> and related |
| documents (including fancy diffs) can be found at |  | documents (including fancy diffs) can be found at |
| <http://www.tools.ietf.org/wg/httpbis/>. |  | <http://www.tools.ietf.org/wg/httpbis/>. |
| This draft incorporates those issue resolutions that were either |  | The changes in this draft are summarized in Appendix D.4. |
| collected in the original RFC2616 errata list |  |  |
| (<http://purl.org/NET/http-errata>), or which were agreed upon on the |  |  |
| mailing list between October 2006 and November 2007 (as published in |  |  |
| "draft-lafon-rfc2616bis-03"). |  |  |
| Table of Contents |  | Table of Contents |
| 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 5 |  | 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 5 |
| 1.1. Requirements . . . . . . . . . . . . . . . . . . . . . . . 5 |  | 1.1. Requirements . . . . . . . . . . . . . . . . . . . . . . . 5 |
| 2. Notational Conventions and Generic Grammar . . . . . . . . . . 5 |  | 2. Notational Conventions and Generic Grammar . . . . . . . . . . 5 |
| 3. Protocol Parameters . . . . . . . . . . . . . . . . . . . . . 6 |  | 3. Protocol Parameters . . . . . . . . . . . . . . . . . . . . . 6 |
| 3.1. Character Sets . . . . . . . . . . . . . . . . . . . . . . 6 |  | 3.1. Character Sets . . . . . . . . . . . . . . . . . . . . . . 6 |
| 3.1.1. Missing Charset . . . . . . . . . . . . . . . . . . . 7 |  | 3.1.1. Missing Charset . . . . . . . . . . . . . . . . . . . 7 |
| 3.2. Content Codings . . . . . . . . . . . . . . . . . . . . . 7 |  | 3.2. Content Codings . . . . . . . . . . . . . . . . . . . . . 7 |
| 3.3. Media Types . . . . . . . . . . . . . . . . . . . . . . . 9 |  | 3.3. Media Types . . . . . . . . . . . . . . . . . . . . . . . 8 |
| 3.3.1. Canonicalization and Text Defaults . . . . . . . . . . 9 |  | 3.3.1. Canonicalization and Text Defaults . . . . . . . . . . 9 |
| 3.3.2. Multipart Types . . . . . . . . . . . . . . . . . . . 10 |  | 3.3.2. Multipart Types . . . . . . . . . . . . . . . . . . . 10 |
| 3.4. Quality Values . . . . . . . . . . . . . . . . . . . . . . 11 |  | 3.4. Quality Values . . . . . . . . . . . . . . . . . . . . . . 11 |
| 3.5. Language Tags . . . . . . . . . . . . . . . . . . . . . . 11 |  | 3.5. Language Tags . . . . . . . . . . . . . . . . . . . . . . 11 |
| 4. Entity . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 |  | 4. Entity . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 |
| 4.1. Entity Header Fields . . . . . . . . . . . . . . . . . . . 12 |  | 4.1. Entity Header Fields . . . . . . . . . . . . . . . . . . . 12 |
| 4.2. Entity Body . . . . . . . . . . . . . . . . . . . . . . . 12 |  | 4.2. Entity Body . . . . . . . . . . . . . . . . . . . . . . . 12 |
| 4.2.1. Type . . . . . . . . . . . . . . . . . . . . . . . . . 13 |  | 4.2.1. Type . . . . . . . . . . . . . . . . . . . . . . . . . 13 |
| 4.2.2. Entity Length . . . . . . . . . . . . . . . . . . . . 13 |  | 4.2.2. Entity Length . . . . . . . . . . . . . . . . . . . . 13 |
| 5. Content Negotiation . . . . . . . . . . . . . . . . . . . . . 13 |  | 5. Content Negotiation . . . . . . . . . . . . . . . . . . . . . 13 |
| skipping to change at page 3, line 39 |  | skipping to change at page 3, line 39 |
| 6.1. Accept . . . . . . . . . . . . . . . . . . . . . . . . . . 16 |  | 6.1. Accept . . . . . . . . . . . . . . . . . . . . . . . . . . 16 |
| 6.2. Accept-Charset . . . . . . . . . . . . . . . . . . . . . . 18 |  | 6.2. Accept-Charset . . . . . . . . . . . . . . . . . . . . . . 18 |
| 6.3. Accept-Encoding . . . . . . . . . . . . . . . . . . . . . 19 |  | 6.3. Accept-Encoding . . . . . . . . . . . . . . . . . . . . . 19 |
| 6.4. Accept-Language . . . . . . . . . . . . . . . . . . . . . 20 |  | 6.4. Accept-Language . . . . . . . . . . . . . . . . . . . . . 20 |
| 6.5. Content-Encoding . . . . . . . . . . . . . . . . . . . . . 22 |  | 6.5. Content-Encoding . . . . . . . . . . . . . . . . . . . . . 22 |
| 6.6. Content-Language . . . . . . . . . . . . . . . . . . . . . 22 |  | 6.6. Content-Language . . . . . . . . . . . . . . . . . . . . . 22 |
| 6.7. Content-Location . . . . . . . . . . . . . . . . . . . . . 23 |  | 6.7. Content-Location . . . . . . . . . . . . . . . . . . . . . 23 |
| 6.8. Content-MD5 . . . . . . . . . . . . . . . . . . . . . . . 24 |  | 6.8. Content-MD5 . . . . . . . . . . . . . . . . . . . . . . . 24 |
| 6.9. Content-Type . . . . . . . . . . . . . . . . . . . . . . . 25 |  | 6.9. Content-Type . . . . . . . . . . . . . . . . . . . . . . . 25 |
| 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 26 |  | 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 26 |
|  |  | 7.1. Message Header Registration . . . . . . . . . . . . . . . 26 |
| 8. Security Considerations . . . . . . . . . . . . . . . . . . . 26 |  | 8. Security Considerations . . . . . . . . . . . . . . . . . . . 26 |
| 8.1. Privacy Issues Connected to Accept Headers . . . . . . . . 26 |  | 8.1. Privacy Issues Connected to Accept Headers . . . . . . . . 26 |
| 8.2. Content-Disposition Issues . . . . . . . . . . . . . . . . 27 |  | 8.2. Content-Disposition Issues . . . . . . . . . . . . . . . . 27 |
| 9. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 27 |  | 9. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 27 |
| 10. References . . . . . . . . . . . . . . . . . . . . . . . . . . 27 |  | 10. References . . . . . . . . . . . . . . . . . . . . . . . . . . 27 |
| 10.1. Normative References . . . . . . . . . . . . . . . . . . . 27 |  | 10.1. Normative References . . . . . . . . . . . . . . . . . . . 27 |
| 10.2. Informative References . . . . . . . . . . . . . . . . . . 29 |  | 10.2. Informative References . . . . . . . . . . . . . . . . . . 29 |
| Appendix A. Differences Between HTTP Entities and RFC 2045 |  | Appendix A. Differences Between HTTP Entities and RFC 2045 |
| Entities . . . . . . . . . . . . . . . . . . . . . . 30 |  | Entities . . . . . . . . . . . . . . . . . . . . . . 30 |
| A.1. MIME-Version . . . . . . . . . . . . . . . . . . . . . . . 30 |  | A.1. MIME-Version . . . . . . . . . . . . . . . . . . . . . . . 31 |
| A.2. Conversion to Canonical Form . . . . . . . . . . . . . . . 30 |  | A.2. Conversion to Canonical Form . . . . . . . . . . . . . . . 31 |
| A.3. Introduction of Content-Encoding . . . . . . . . . . . . . 31 |  | A.3. Introduction of Content-Encoding . . . . . . . . . . . . . 31 |
| A.4. No Content-Transfer-Encoding . . . . . . . . . . . . . . . 31 |  | A.4. No Content-Transfer-Encoding . . . . . . . . . . . . . . . 32 |
| A.5. Introduction of Transfer-Encoding . . . . . . . . . . . . 31 |  | A.5. Introduction of Transfer-Encoding . . . . . . . . . . . . 32 |
| A.6. MHTML and Line Length Limitations . . . . . . . . . . . . 32 |  | A.6. MHTML and Line Length Limitations . . . . . . . . . . . . 32 |
| Appendix B. Additional Features . . . . . . . . . . . . . . . . . 32 |  | Appendix B. Additional Features . . . . . . . . . . . . . . . . . 32 |
| B.1. Content-Disposition . . . . . . . . . . . . . . . . . . . 32 |  | B.1. Content-Disposition . . . . . . . . . . . . . . . . . . . 33 |
| Appendix C. Compatibility with Previous Versions . . . . . . . . 33 |  | Appendix C. Compatibility with Previous Versions . . . . . . . . 33 |
| C.1. Changes from RFC 2068 . . . . . . . . . . . . . . . . . . 33 |  | C.1. Changes from RFC 2068 . . . . . . . . . . . . . . . . . . 33 |
| C.2. Changes from RFC 2616 . . . . . . . . . . . . . . . . . . 33 |  | C.2. Changes from RFC 2616 . . . . . . . . . . . . . . . . . . 34 |
| Appendix D. Change Log (to be removed by RFC Editor before |  | Appendix D. Change Log (to be removed by RFC Editor before |
| publication) . . . . . . . . . . . . . . . . . . . . 34 |  | publication) . . . . . . . . . . . . . . . . . . . . 34 |
| D.1. Since RFC2616 . . . . . . . . . . . . . . . . . . . . . . 34 |  | D.1. Since RFC2616 . . . . . . . . . . . . . . . . . . . . . . 34 |
| D.2. Since draft-ietf-httpbis-p3-payload-00 . . . . . . . . . . 34 |  | D.2. Since draft-ietf-httpbis-p3-payload-00 . . . . . . . . . . 34 |
| D.3. Since draft-ietf-httpbis-p3-payload-01 . . . . . . . . . . 35 |  | D.3. Since draft-ietf-httpbis-p3-payload-01 . . . . . . . . . . 35 |
| Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 |  | D.4. Since draft-ietf-httpbis-p3-payload-02 . . . . . . . . . . 35 |
| Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 37 |  | Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 |
| Intellectual Property and Copyright Statements . . . . . . . . . . 40 |  | Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 38 |
|  |  | Intellectual Property and Copyright Statements . . . . . . . . . . 41 |
| 1. Introduction |  | 1. Introduction |
| This document defines HTTP/1.1 message payloads (a.k.a., content), |  | This document defines HTTP/1.1 message payloads (a.k.a., content), |
| the associated metadata header fields that define how the payload is |  | the associated metadata header fields that define how the payload is |
| intended to be interpreted by a recipient, the request header fields |  | intended to be interpreted by a recipient, the request header fields |
| that may influence content selection, and the various selection |  | that may influence content selection, and the various selection |
| algorithms that are collectively referred to as HTTP content |  | algorithms that are collectively referred to as HTTP content |
| negotiation. |  | negotiation. |
| skipping to change at page 6, line 13 |  | skipping to change at page 6, line 13 |
| quoted-string = <quoted-string, defined in [Part1], Section 2.2> |  | quoted-string = <quoted-string, defined in [Part1], Section 2.2> |
| token = <token, defined in [Part1], Section 2.2> |  | token = <token, defined in [Part1], Section 2.2> |
| The ABNF rules below are defined in other parts: |  | The ABNF rules below are defined in other parts: |
| absoluteURI = <absoluteURI, defined in [Part1], Section 3.2.1> |  | absoluteURI = <absoluteURI, defined in [Part1], Section 3.2.1> |
| Content-Length = <Content-Length, defined in [Part1], Section 8.2> |  | Content-Length = <Content-Length, defined in [Part1], Section 8.2> |
| relativeURI = <relativeURI, defined in [Part1], Section 3.2.1> |  | relativeURI = <relativeURI, defined in [Part1], Section 3.2.1> |
| message-header = <message-header, defined in [Part1], Section 4.2> |  | message-header = <message-header, defined in [Part1], Section 4.2> |
| Allow = <Allow, defined in [Part2], Section 10.1> |  |  |
| Last-Modified = <Last-Modified, defined in [Part4], Section 7.6> |  | Last-Modified = <Last-Modified, defined in [Part4], Section 7.6> |
| Content-Range = <Content-Range, defined in [Part5], Section 6.2> |  | Content-Range = <Content-Range, defined in [Part5], Section 6.2> |
| Expires = <Expires, defined in [Part6], Section 16.3> |  | Expires = <Expires, defined in [Part6], Section 16.3> |
| 3. Protocol Parameters |  | 3. Protocol Parameters |
| 3.1. Character Sets |  | 3.1. Character Sets |
| skipping to change at page 9, line 30 |  | skipping to change at page 9, line 25 |
| value = token | quoted-string |  | value = token | quoted-string |
| The type, subtype, and parameter attribute names are case- |  | The type, subtype, and parameter attribute names are case- |
| insensitive. Parameter values might or might not be case-sensitive, |  | insensitive. Parameter values might or might not be case-sensitive, |
| depending on the semantics of the parameter name. Linear white space |  | depending on the semantics of the parameter name. Linear white space |
| (LWS) MUST NOT be used between the type and subtype, nor between an |  | (LWS) MUST NOT be used between the type and subtype, nor between an |
| attribute and its value. The presence or absence of a parameter |  | attribute and its value. The presence or absence of a parameter |
| might be significant to the processing of a media-type, depending on |  | might be significant to the processing of a media-type, depending on |
| its definition within the media type registry. |  | its definition within the media type registry. |
|  |  | All parameters defined as a token are also allowed to occur as |
|  |  | quoted-string; both notations are equivalent. |
| Note that some older HTTP applications do not recognize media type |  | Note that some older HTTP applications do not recognize media type |
| parameters. When sending data to older HTTP applications, |  | parameters. When sending data to older HTTP applications, |
| implementations SHOULD only use media type parameters when they are |  | implementations SHOULD only use media type parameters when they are |
| required by that type/subtype definition. |  | required by that type/subtype definition. |
| Media-type values are registered with the Internet Assigned Number |  | Media-type values are registered with the Internet Assigned Number |
| Authority (IANA). The media type registration process is outlined in |  | Authority (IANA). The media type registration process is outlined in |
| [RFC4288]. Use of non-registered media types is discouraged. |  | [RFC4288]. Use of non-registered media types is discouraged. |
| 3.3.1. Canonicalization and Text Defaults |  | 3.3.1. Canonicalization and Text Defaults |
| skipping to change at page 12, line 21 |  | skipping to change at page 12, line 21 |
| responses will only include the entity-headers. |  | responses will only include the entity-headers. |
| In this section, both sender and recipient refer to either the client |  | In this section, both sender and recipient refer to either the client |
| or the server, depending on who sends and who receives the entity. |  | or the server, depending on who sends and who receives the entity. |
| 4.1. Entity Header Fields |  | 4.1. Entity Header Fields |
| Entity-header fields define metainformation about the entity-body or, |  | Entity-header fields define metainformation about the entity-body or, |
| if no body is present, about the resource identified by the request. |  | if no body is present, about the resource identified by the request. |
| entity-header = Allow ; [Part2], Section 10.1 |  | entity-header = Content-Encoding ; Section 6.5 |
| | Content-Encoding ; Section 6.5 |  |  |
| | Content-Language ; Section 6.6 |  | | Content-Language ; Section 6.6 |
| | Content-Length ; [Part1], Section 8.2 |  | | Content-Length ; [Part1], Section 8.2 |
| | Content-Location ; Section 6.7 |  | | Content-Location ; Section 6.7 |
| | Content-MD5 ; Section 6.8 |  | | Content-MD5 ; Section 6.8 |
| | Content-Range ; [Part5], Section 6.2 |  | | Content-Range ; [Part5], Section 6.2 |
| | Content-Type ; Section 6.9 |  | | Content-Type ; Section 6.9 |
| | Expires ; [Part6], Section 16.3 |  | | Expires ; [Part6], Section 16.3 |
| | Last-Modified ; [Part4], Section 7.6 |  | | Last-Modified ; [Part4], Section 7.6 |
| | extension-header |  | | extension-header |
| skipping to change at page 19, line 28 |  | skipping to change at page 19, line 28 |
| 6.3. Accept-Encoding |  | 6.3. Accept-Encoding |
| The Accept-Encoding request-header field is similar to Accept, but |  | The Accept-Encoding request-header field is similar to Accept, but |
| restricts the content-codings (Section 3.2) that are acceptable in |  | restricts the content-codings (Section 3.2) that are acceptable in |
| the response. |  | the response. |
| Accept-Encoding = "Accept-Encoding" ":" |  | Accept-Encoding = "Accept-Encoding" ":" |
| #( codings [ ";" "q" "=" qvalue ] ) |  | #( codings [ ";" "q" "=" qvalue ] ) |
| codings = ( content-coding | "*" ) |  | codings = ( content-coding | "*" ) |
|  |  | Each codings value MAY be given an associated quality value which |
|  |  | represents the preference for that encoding. The default value is |
|  |  | q=1. |
| Examples of its use are: |  | Examples of its use are: |
| Accept-Encoding: compress, gzip |  | Accept-Encoding: compress, gzip |
| Accept-Encoding: |  | Accept-Encoding: |
| Accept-Encoding: * |  | Accept-Encoding: * |
| Accept-Encoding: compress;q=0.5, gzip;q=1.0 |  | Accept-Encoding: compress;q=0.5, gzip;q=1.0 |
| Accept-Encoding: gzip;q=1.0, identity; q=0.5, *;q=0 |  | Accept-Encoding: gzip;q=1.0, identity; q=0.5, *;q=0 |
| A server tests whether a content-coding is acceptable, according to |  | A server tests whether a content-coding is acceptable, according to |
| an Accept-Encoding field, using these rules: |  | an Accept-Encoding field, using these rules: |
| skipping to change at page 26, line 7 |  | skipping to change at page 26, line 7 |
| Media types are defined in Section 3.3. An example of the field is |  | Media types are defined in Section 3.3. An example of the field is |
| Content-Type: text/html; charset=ISO-8859-4 |  | Content-Type: text/html; charset=ISO-8859-4 |
| Further discussion of methods for identifying the media type of an |  | Further discussion of methods for identifying the media type of an |
| entity is provided in Section 4.2.1. |  | entity is provided in Section 4.2.1. |
| 7. IANA Considerations |  | 7. IANA Considerations |
| [[anchor1: TBD.]] |  | 7.1. Message Header Registration |
|  |  | The Message Header Registry located at <http://www.iana.org/ |
|  |  | assignments/message-headers/message-header-index.html> should be |
|  |  | updated with the permanent registrations below (see [RFC3864]): |
|  |  | +---------------------+----------+----------+--------------+ |
|  |  | | Header Field Name | Protocol | Status | Reference | |
|  |  | +---------------------+----------+----------+--------------+ |
|  |  | | Accept | http | standard | Section 6.1 | |
|  |  | | Accept-Charset | http | standard | Section 6.2 | |
|  |  | | Accept-Encoding | http | standard | Section 6.3 | |
|  |  | | Accept-Language | http | standard | Section 6.4 | |
|  |  | | Content-Disposition | http | | Appendix B.1 | |
|  |  | | Content-Encoding | http | standard | Section 6.5 | |
|  |  | | Content-Language | http | standard | Section 6.6 | |
|  |  | | Content-Location | http | standard | Section 6.7 | |
|  |  | | Content-MD5 | http | standard | Section 6.8 | |
|  |  | | Content-Type | http | standard | Section 6.9 | |
|  |  | +---------------------+----------+----------+--------------+ |
|  |  | The change controller is: "IETF (iesg@ietf.org) - Internet |
|  |  | Engineering Task Force". |
| 8. Security Considerations |  | 8. Security Considerations |
| This section is meant to inform application developers, information |  | This section is meant to inform application developers, information |
| providers, and users of the security limitations in HTTP/1.1 as |  | providers, and users of the security limitations in HTTP/1.1 as |
| described by this document. The discussion does not include |  | described by this document. The discussion does not include |
| definitive solutions to the problems revealed, though it does make |  | definitive solutions to the problems revealed, though it does make |
| some suggestions for reducing security risks. |  | some suggestions for reducing security risks. |
| 8.1. Privacy Issues Connected to Accept Headers |  | 8.1. Privacy Issues Connected to Accept Headers |
| skipping to change at page 27, line 29 |  | skipping to change at page 28, line 4 |
| [ISO-8859-1] |  | [ISO-8859-1] |
| International Organization for Standardization, |  | International Organization for Standardization, |
| "Information technology -- 8-bit single-byte coded graphic |  | "Information technology -- 8-bit single-byte coded graphic |
| character sets -- Part 1: Latin alphabet No. 1", ISO/ |  | character sets -- Part 1: Latin alphabet No. 1", ISO/ |
| IEC 8859-1:1998, 1998. |  | IEC 8859-1:1998, 1998. |
| [Part1] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., |  | [Part1] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., |
| Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., |  | Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., |
| and J. Reschke, Ed., "HTTP/1.1, part 1: URIs, Connections, |  | and J. Reschke, Ed., "HTTP/1.1, part 1: URIs, Connections, |
| and Message Parsing", draft-ietf-httpbis-p1-messaging-02 |  | and Message Parsing", draft-ietf-httpbis-p1-messaging-03 |
| (work in progress), February 2008. |  | (work in progress), June 2008. |
| [Part2] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., |  | [Part2] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., |
| Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., |  | Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., |
| and J. Reschke, Ed., "HTTP/1.1, part 2: Message |  | and J. Reschke, Ed., "HTTP/1.1, part 2: Message |
| Semantics", draft-ietf-httpbis-p2-semantics-02 (work in |  | Semantics", draft-ietf-httpbis-p2-semantics-03 (work in |
| progress), February 2008. |  | progress), June 2008. |
| [Part4] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., |  | [Part4] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., |
| Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., |  | Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., |
| and J. Reschke, Ed., "HTTP/1.1, part 4: Conditional |  | and J. Reschke, Ed., "HTTP/1.1, part 4: Conditional |
| Requests", draft-ietf-httpbis-p4-conditional-02 (work in |  | Requests", draft-ietf-httpbis-p4-conditional-03 (work in |
| progress), February 2008. |  | progress), June 2008. |
| [Part5] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., |  | [Part5] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., |
| Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., |  | Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., |
| and J. Reschke, Ed., "HTTP/1.1, part 5: Range Requests and |  | and J. Reschke, Ed., "HTTP/1.1, part 5: Range Requests and |
| Partial Responses", draft-ietf-httpbis-p5-range-02 (work |  | Partial Responses", draft-ietf-httpbis-p5-range-03 (work |
| in progress), February 2008. |  | in progress), June 2008. |
| [Part6] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., |  | [Part6] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., |
| Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., |  | Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., |
| and J. Reschke, Ed., "HTTP/1.1, part 6: Caching", |  | and J. Reschke, Ed., "HTTP/1.1, part 6: Caching", |
| draft-ietf-httpbis-p6-cache-02 (work in progress), |  | draft-ietf-httpbis-p6-cache-03 (work in progress), |
| February 2008. |  | June 2008. |
| [RFC1766] Alvestrand, H., "Tags for the Identification of |  | [RFC1766] Alvestrand, H., "Tags for the Identification of |
| Languages", RFC 1766, March 1995. |  | Languages", RFC 1766, March 1995. |
| [RFC1864] Myers, J. and M. Rose, "The Content-MD5 Header Field", |  | [RFC1864] Myers, J. and M. Rose, "The Content-MD5 Header Field", |
| RFC 1864, October 1995. |  | RFC 1864, October 1995. |
| [RFC1950] Deutsch, L. and J-L. Gailly, "ZLIB Compressed Data Format |  | [RFC1950] Deutsch, L. and J-L. Gailly, "ZLIB Compressed Data Format |
| Specification version 3.3", RFC 1950, May 1996. |  | Specification version 3.3", RFC 1950, May 1996. |
| skipping to change at page 29, line 50 |  | skipping to change at page 30, line 25 |
| [RFC2616] Fielding, R., Gettys, J., Mogul, J., Frystyk, H., |  | [RFC2616] Fielding, R., Gettys, J., Mogul, J., Frystyk, H., |
| Masinter, L., Leach, P., and T. Berners-Lee, "Hypertext |  | Masinter, L., Leach, P., and T. Berners-Lee, "Hypertext |
| Transfer Protocol -- HTTP/1.1", RFC 2616, June 1999. |  | Transfer Protocol -- HTTP/1.1", RFC 2616, June 1999. |
| [RFC2822] Resnick, P., "Internet Message Format", RFC 2822, |  | [RFC2822] Resnick, P., "Internet Message Format", RFC 2822, |
| April 2001. |  | April 2001. |
| [RFC3629] Yergeau, F., "UTF-8, a transformation format of ISO |  | [RFC3629] Yergeau, F., "UTF-8, a transformation format of ISO |
| 10646", RFC 3629, STD 63, November 2003. |  | 10646", RFC 3629, STD 63, November 2003. |
|  |  | [RFC3864] Klyne, G., Nottingham, M., and J. Mogul, "Registration |
|  |  | Procedures for Message Header Fields", BCP 90, RFC 3864, |
|  |  | September 2004. |
| [RFC4288] Freed, N. and J. Klensin, "Media Type Specifications and |  | [RFC4288] Freed, N. and J. Klensin, "Media Type Specifications and |
| Registration Procedures", BCP 13, RFC 4288, December 2005. |  | Registration Procedures", BCP 13, RFC 4288, December 2005. |
| Appendix A. Differences Between HTTP Entities and RFC 2045 Entities |  | Appendix A. Differences Between HTTP Entities and RFC 2045 Entities |
| HTTP/1.1 uses many of the constructs defined for Internet Mail |  | HTTP/1.1 uses many of the constructs defined for Internet Mail |
| ([RFC2822]) and the Multipurpose Internet Mail Extensions (MIME |  | ([RFC2822]) and the Multipurpose Internet Mail Extensions (MIME |
| [RFC2045]) to allow entities to be transmitted in an open variety of |  | [RFC2045]) to allow entities to be transmitted in an open variety of |
| representations and with extensible mechanisms. However, RFC 2045 |  | representations and with extensible mechanisms. However, RFC 2045 |
| discusses mail, and HTTP has a few features that are different from |  | discusses mail, and HTTP has a few features that are different from |
| skipping to change at page 35, line 13 |  | skipping to change at page 35, line 33 |
| up-to-date references" |  | up-to-date references" |
| D.3. Since draft-ietf-httpbis-p3-payload-01 |  | D.3. Since draft-ietf-httpbis-p3-payload-01 |
| Ongoing work on ABNF conversion |  | Ongoing work on ABNF conversion |
| (<http://www3.tools.ietf.org/wg/httpbis/trac/ticket/36>): |  | (<http://www3.tools.ietf.org/wg/httpbis/trac/ticket/36>): |
| o Add explicit references to BNF syntax and rules imported from |  | o Add explicit references to BNF syntax and rules imported from |
| other parts of the specification. |  | other parts of the specification. |
|  |  | D.4. Since draft-ietf-httpbis-p3-payload-02 |
|  |  | Closed issues: |
|  |  | o <http://www3.tools.ietf.org/wg/httpbis/trac/ticket/67>: "Quoting |
|  |  | Charsets" |
|  |  | o <http://www3.tools.ietf.org/wg/httpbis/trac/ticket/105>: |
|  |  | "Classification for Allow header" |
|  |  | o <http://www3.tools.ietf.org/wg/httpbis/trac/ticket/115>: "missing |
|  |  | default for qvalue in description of Accept-Encoding" |
|  |  | Ongoing work on IANA Message Header Registration |
|  |  | (<http://www3.tools.ietf.org/wg/httpbis/trac/ticket/40>): |
|  |  | o Reference RFC 3984, and update header registrations for headers |
|  |  | defined in this document. |
| Index |  | Index |
| A |  | A |
| Accept header 16 |  | Accept header 16 |
| Accept-Charset header 18 |  | Accept-Charset header 18 |
| Accept-Encoding header 19 |  | Accept-Encoding header 19 |
| Accept-Language header 20 |  | Accept-Language header 20 |
| Alternates header 33 |  | Alternates header 34 |
| C |  | C |
| compress 8 |  | compress 8 |
| Content-Base header 33 |  | Content-Base header 34 |
| Content-Disposition header 32 |  | Content-Disposition header 33 |
| Content-Encoding header 22 |  | Content-Encoding header 22 |
| Content-Language header 22 |  | Content-Language header 22 |
| Content-Location header 23 |  | Content-Location header 23 |
| Content-MD5 header 24 |  | Content-MD5 header 24 |
| Content-Type header 25 |  | Content-Type header 25 |
| Content-Version header 33 |  | Content-Version header 34 |
| D |  | D |
| deflate 8 |  | deflate 8 |
| Derived-From header 33 |  | Derived-From header 34 |
| G |  | G |
| Grammar |  | Grammar |
| Accept 16 |  | Accept 16 |
| Accept-Charset 18 |  | Accept-Charset 18 |
| Accept-Encoding 19 |  | Accept-Encoding 19 |
| accept-extension 16 |  | accept-extension 16 |
| Accept-Language 20 |  | Accept-Language 20 |
| accept-params 16 |  | accept-params 16 |
| attribute 9 |  | attribute 9 |
| charset 7 |  | charset 7 |
| codings 19 |  | codings 19 |
| content-coding 7 |  | content-coding 7 |
| content-disposition 32 |  | content-disposition 33 |
| Content-Encoding 22 |  | Content-Encoding 22 |
| Content-Language 22 |  | Content-Language 22 |
| Content-Location 23 |  | Content-Location 23 |
| Content-MD5 24 |  | Content-MD5 24 |
| Content-Type 25 |  | Content-Type 25 |
| disp-extension-parm 32 |  | disp-extension-parm 33 |
| disp-extension-token 32 |  | disp-extension-token 33 |
| disposition-parm 32 |  | disposition-parm 33 |
| disposition-type 32 |  | disposition-type 33 |
| entity-body 12 |  | entity-body 12 |
| entity-header 12 |  | entity-header 12 |
| extension-header 12 |  | extension-header 12 |
| filename-parm 32 |  | filename-parm 33 |
| language-range 20 |  | language-range 20 |
| language-tag 11 |  | language-tag 11 |
| md5-digest 24 |  | md5-digest 24 |
| media-range 16 |  | media-range 16 |
| media-type 9 |  | media-type 9 |
| MIME-Version 30 |  | MIME-Version 31 |
| parameter 9 |  | parameter 9 |
| primary-tag 11 |  | primary-tag 11 |
| qvalue 11 |  | qvalue 11 |
| subtag 11 |  | subtag 11 |
| subtype 9 |  | subtype 9 |
| type 9 |  | type 9 |
| value 9 |  | value 9 |
| gzip 8 |  | gzip 8 |
| H |  | H |
| Headers |  | Headers |
| Accept 16 |  | Accept 16 |
| Accept-Charset 18 |  | Accept-Charset 18 |
| Accept-Encoding 19 |  | Accept-Encoding 19 |
| Accept-Language 20 |  | Accept-Language 20 |
| Alternate 33 |  | Alternate 34 |
| Content-Base 33 |  | Content-Base 34 |
| Content-Disposition 32 |  | Content-Disposition 33 |
| Content-Encoding 22 |  | Content-Encoding 22 |
| Content-Language 22 |  | Content-Language 22 |
| Content-Location 23 |  | Content-Location 23 |
| Content-MD5 24 |  | Content-MD5 24 |
| Content-Type 25 |  | Content-Type 25 |
| Content-Version 33 |  | Content-Version 34 |
| Derived-From 33 |  | Derived-From 34 |
| Link 33 |  | Link 34 |
| Public 33 |  | Public 34 |
| URI 33 |  | URI 34 |
| I |  | I |
| identity 8 |  | identity 8 |
| L |  | L |
| Link header 33 |  | Link header 34 |
| P |  | P |
| Public header 33 |  | Public header 34 |
| U |  | U |
| URI header 33 |  | URI header 34 |
| Authors' Addresses |  | Authors' Addresses |
| Roy T. Fielding (editor) |  | Roy T. Fielding (editor) |
| Day Software |  | Day Software |
| 23 Corporate Plaza DR, Suite 280 |  | 23 Corporate Plaza DR, Suite 280 |
| Newport Beach, CA 92660 |  | Newport Beach, CA 92660 |
| USA |  | USA |
| Phone: +1-949-706-5300 |  | Phone: +1-949-706-5300 |
| skipping to change at page 40, line 44 |  | skipping to change at line 1822 |
| attempt made to obtain a general license or permission for the use of |  | attempt made to obtain a general license or permission for the use of |
| such proprietary rights by implementers or users of this |  | such proprietary rights by implementers or users of this |
| specification can be obtained from the IETF on-line IPR repository at |  | specification can be obtained from the IETF on-line IPR repository at |
| http://www.ietf.org/ipr. |  | http://www.ietf.org/ipr. |
| The IETF invites any interested party to bring to its attention any |  | The IETF invites any interested party to bring to its attention any |
| copyrights, patents or patent applications, or other proprietary |  | copyrights, patents or patent applications, or other proprietary |
| rights that may cover technology that may be required to implement |  | rights that may cover technology that may be required to implement |
| this standard. Please address the information to the IETF at |  | this standard. Please address the information to the IETF at |
| ietf-ipr@ietf.org. |  | ietf-ipr@ietf.org. |
| Acknowledgment |  |  |
| Funding for the RFC Editor function is provided by the IETF |  |  |
| Administrative Support Activity (IASA). |  |  |
End of changes. 39 change blocks.
| 61 lines changed or deleted |  | 105 lines changed or added |
This html diff was produced by rfcdiff 1.34. The latest version is available from http://tools.ietf.org/tools/rfcdiff/