Subject: Re: [http-extensions] Adding `commit` member to JSON (#151)

From: HTTP issue updates <[email-masked]>
Date: Mon, 07 Mar 2016 20:22:40 -0800

>  
>  ~~~ example
> -    GET /index.html HTTP/1.1
> -    Host: example.com
> -~~~
> -
> -~~~ example
> -    HTTP/1.1 200 OK
> -    Content-Type: text/html
> -    Cache-Control: max-age=600
> -    Age: 30
> -    Date: Thu, 1 May 2014 16:20:09 GMT
> -    HTTP-TLS: ma=3600
> +{
> +  "origins": ["http://example.com:80", "http://www.example.com/:81"],
> +  "commit": "2016-03-12T12:27:00Z"

Yes, sync issues.  But certificates are similarly challenged, and I want to be able to lift one of these out of a cache.  That's a reasonable thing to do right?

---
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/pull/151/files#r55314784

---

From: HTTP issue updates <[email-masked]>
Date: Mon, 07 Mar 2016 20:23:59 -0800

>  ~~~
>  
> -This header field creates a commitment from the origin {{RFC6454}} of the associated resource (in
> -the example, `http://example.com`).  For the duration of the commitment, clients SHOULD strongly
> -authenticate the server for all subsequent requests made to that origin, though this creates some
> -risks for clients (see {{pinrisks}}).
> -
> -Authentication for HTTP over TLS is described in Section 3.1 of {{RFC2818}}, noting the additional
> -requirements in Section 2.1 of {{I-D.ietf-httpbis-alt-svc}}. The header field MUST be ignored if
> -strong authentication fails; otherwise, an attacker could create a persistent denial of service by
> -falsifying a commitment.
> +The value of the `commit` member MUST be ignored unless the alternative service can be strongly
> +authenticated.  Minimum authentication requirements for HTTP over TLS are described in Section 2.1
> +of {{I-D.ietf-httpbis-alt-svc}} and Section 3.1 of {{RFC2818}}.  As noted in
> +{{I-D.ietf-httpbis-alt-svc}}, clients can impose other checks in addition to this minimum set.  For
> +instance, a client might choose to apply key pinning {{RFC7469}}.

This is the essential weirdness of this mechanism.  You don't *have* to authenticate, but you can.

---
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/pull/151/files#r55314849

---

From: HTTP issue updates <[email-masked]>
Date: Mon, 07 Mar 2016 21:03:58 -0800

> +  "commit": "2016-03-12T12:27:00Z"

I was assuming that a typical case would be just wanting to try it out by assigning a relatively short commitment period.

---
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/pull/151/files#r55316758

---

From: HTTP issue updates <[email-masked]>
Date: Mon, 07 Mar 2016 21:44:17 -0800

And lo, relativism became ascendant.

---
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/pull/151#issuecomment-193618278

---

From: HTTP issue updates <[email-masked]>
Date: Thu, 10 Mar 2016 19:32:39 -0800

Merged #151.

---
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/pull/151#event-585865364