Subject: Re: [httpwg/http-extensions] Reword exclusion regarding retries (#616)

From: HTTP issue updates <[email-masked]>
Date: Tue, 08 May 2018 16:07:28 -0700

You're still glossing over the fact that retries can be initiated by something other than the client, but this focuses specifically on client-initiated actions, so that's probably okay.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/pull/616#issuecomment-387570174

---

From: HTTP issue updates <[email-masked]>
Date: Tue, 08 May 2018 16:58:45 -0700

The glossing-over is intentional. :)

Getting into what an intermediary might do here is what the rest of the document covers.  The primary point here is to separate replay from intentional retries.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/pull/616#issuecomment-387578572

---

From: HTTP issue updates <[email-masked]>
Date: Tue, 08 May 2018 22:07:55 -0700

I'm not seeing the benefit of the rewording here. How about this instead ?

The difference between replay attacks and retries is that retries may be performed by a user, a client or an intermediary for the purpose of getting a response that will be delivered to the client, while a replay attack is generally performed by a third party not part of the chain from the client to the server, which is not interested in receiving a response, will often not receive it, and not even know whether or not such a response was provided or not.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/pull/616#issuecomment-387621379