Subject: [httpwg/http-extensions] Confusion Regarding Request Scheme (#167)

From: HTTP issue updates <[email-masked]>
Date: Mon, 04 Apr 2016 12:25:18 -0700

See <https://lists.w3.org/Archives/Public/ietf-http-wg/2016JanMar/0531.html>:

With the latest changes, this now reads:

"Some HTTP/1.1 implementations use ambient signals to determine if a 
request is for an https resource. For example, implementations might 
look for TLS on the stack or a port number of 443. This is necessary in 
many cases because the most common form of an HTTP/1.1 request does not 
carry an explicit indication of the URI scheme. An implementation that 
is serving an opportunistically secured request SHOULD suppress these 
signals for http resources.

HTTP/1.1 MUST NOT be used to serve opportunistically secured requests. 
HTTP/1.1 can be used to discover an opportunistically secured 
alternative service."

The problem remains that this is not really specific to HTTP/1.1; for 
instance, code running inside Apache over HTTP/2 may have exactly the 
same problem (Stefan E. to confirm); so it's more a matter of HTTP 
server internal APIs, not the on-the-wire protocol.

I believe this needs to be rephrased to better explain the actual 
problem; and I also remain unconvinced that the conclusion wrt HTTP/1.1 
makes sense.

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/167