Subject: [httpwg/http-extensions] ORIGIN and server authority (#349)

From: HTTP issue updates <[email-masked]>
Date: Mon, 22 May 2017 22:06:26 -0700

I'm reading the bit that touches on [server authority](http://httpwg.org/http-extensions/origin-frame.html#authority) and it's kinda vague on what the server is authoritative for.

I see two alternatives: 

1. ORIGIN is an explicit disavowal of authority for any name for which the server would otherwise be authoritative for.
2. ORIGIN doesn't say anything about authority, but instead relies on the definitions in RFC 7230 and 7540.  What it does say is that requests made to (or pushed for) origins that aren't in the Origin Set are somehow invalid.

I think that the text leans toward option 1, but it could be the latter.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/349

---

From: HTTP issue updates <[email-masked]>
Date: Mon, 22 May 2017 23:20:07 -0700

I don't want to get into a situation where a connection's authority changes based upon the ability of the client to understand an optional-to-implement frame; that's why the draft is written how it is (i.e., not directly affecting authority).

So, your #2 is closer to the mark. If the client understands and implements ORIGIN, a new set of requirements are applied to it, ones that take certain origins out of consideration for actual use (not authority) for a given connection.

Yes, this could be clarified. It also makes me think we might not want to have ORIGIN apply to server push.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/349#issuecomment-303301293