Subject: Re: [quicwg/base-drafts] QPACK: Updated Static Table (#1355)

From: Martin Thomson <[email-masked]>
Date: Tue, 04 Sep 2018 15:36:36 -0700

martinthomson commented on this pull request.

> +| 40    | content-type                     | application/json                                      |
+| 41    | content-type                     | application/json; charset=utf-8                       |
+| 42    | content-type                     | application/x-www-form-urlencoded                     |
+| 43    | content-type                     | application/x-www-form-urlencoded; charset=utf-8      |
+| 44    | content-type                     | image/gif                                             |
+| 45    | content-type                     | image/jpeg                                            |
+| 46    | content-type                     | image/png                                             |
+| 47    | content-type                     | text/css                                              |
+| 48    | content-type                     | text/html; charset=utf-8                              |
+| 49    | content-type                     | text/javascript                                       |
+| 50    | content-type                     | text/javascript; charset=utf-8                        |
+| 51    | content-type                     | text/plain                                            |
+| 52    | content-type                     | text/plain;charset=utf-8                              |
+| 53    | range                            | bytes=0-                                              |
+| 54    | server                           |                                                       |
+| 55    | strict-transport-security        | max-age=10886400; includesubdomains; preload          |

I have a request.  Take this out and move :status: 103 up into the one-byte range.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1355#pullrequestreview-152279194

---

From: Martin Thomson <[email-masked]>
Date: Tue, 04 Sep 2018 15:37:32 -0700

> +| 26    | accept                           | */*                                                   |
+| 27    | accept                           | application/dns-message                               |
+| 28    | accept-encoding                  | gzip, deflate, br                                     |
+| 29    | accept-language                  |                                                       |
+| 30    | authorization                    |                                                       |
+| 31    | cache-control                    | max-age=0                                             |
+| 32    | cache-control                    | max-age=604800                                        |
+| 33    | cache-control                    | max-age=2592000                                       |
+| 34    | cache-control                    | no-cache                                              |
+| 35    | cache-control                    | no-cache, no-store, must-revalidate                   |
+| 36    | cache-control                    | public, max-age=31536000                              |
+| 37    | content-encoding                 | br                                                    |
+| 38    | content-type                     | application/dns-message                               |
+| 39    | content-type                     | application/javascript                                |
+| 40    | content-type                     | application/json                                      |
+| 41    | content-type                     | application/json; charset=utf-8                       |

Maybe we shouldn't include charset parameters either.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1355#pullrequestreview-152279398

---

From: Mike Bishop <[email-masked]>
Date: Mon, 17 Sep 2018 12:48:20 -0700

MikeBishop commented on this pull request.

Per discussion, we'll drop charsets from everything except text/html and perhaps text/plain.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1355#discussion_r218202894

---

From: Martin Thomson <[email-masked]>
Date: Mon, 17 Sep 2018 12:51:17 -0700

https://datatracker.ietf.org/doc/draft-ietf-dispatch-javascript-mjs/ deprecates this, so remove both text/javascript options.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1355#pullrequestreview-156090091

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 18 Sep 2018 09:11:24 -0700

mnot commented on this pull request.

> @@ -1004,6 +1002,119 @@ Description:
 
 --- back
 
+# Static Table
+
+| Index | Name                             | Value                                                 |
+| ----- | -------------------------------- | ----------------------------------------------------- |
+| 0     | :authority                       |                                                       |
+| 1     | :path                            | /                                                     |
+| 2     | age                              | 0                                                     |

Seems pretty low-value; will never appear in a request, and it's just three letters.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1355#pullrequestreview-156447440

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 18 Sep 2018 16:11:59 +0000 (UTC)

> +| 12    | location                         |                                                       |
+| 13    | referer                          |                                                       |
+| 14    | set-cookie                       |                                                       |
+| 15    | :method                          | CONNECT                                               |
+| 16    | :method                          | DELETE                                                |
+| 17    | :method                          | GET                                                   |
+| 18    | :method                          | HEAD                                                  |
+| 19    | :method                          | OPTIONS                                               |
+| 20    | :method                          | POST                                                  |
+| 21    | :method                          | PUT                                                   |
+| 22    | :scheme                          | http                                                  |
+| 23    | :scheme                          | https                                                 |
+| 24    | :status                          | 200                                                   |
+| 25    | :status                          | 304                                                   |
+| 26    | accept                           | */*                                                   |
+| 27    | accept                           | application/dns-message                               |

Seriously?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1355#pullrequestreview-156447651

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 18 Sep 2018 09:12:57 -0700

+| 21    | :method                          | PUT                                                   |
+| 22    | :scheme                          | http                                                  |

this has equivalent semantics to 'no-store'. I know some variation on this is common practice, but it's bad practice, and I doubt that there's enough convergence on this particular spelling to make the codification of that bad practice worthwhile. Just do `no-store`.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1355#pullrequestreview-156448081

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 18 Sep 2018 16:14:03 +0000 (UTC)

+| 47    | content-type                     | text/css                                              |
+| 48    | content-type                     | text/html; charset=utf-8                              |
+| 49    | content-type                     | text/javascript                                       |
+| 50    | content-type                     | text/javascript; charset=utf-8                        |
+| 51    | content-type                     | text/plain                                            |
+| 52    | content-type                     | text/plain;charset=utf-8                              |
+| 53    | range                            | bytes=0-                                              |
+| 54    | server                           |                                                       |
+| 55    | strict-transport-security        | max-age=10886400; includesubdomains; preload          |
+| 56    | strict-transport-security        | max-age=31536000                                      |
+| 57    | strict-transport-security        | max-age=31536000; includesubdomains                   |
+| 58    | strict-transport-security        | max-age=31536000; includesubdomains; preload          |
+| 59    | user-agent                       |                                                       |
+| 60    | vary                             | accept-encoding                                       |
+| 61    | vary                             | accept-encoding, user-agent                           |

This is actively bad practice; it should not be encouraged.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1355#pullrequestreview-156448380

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 18 Sep 2018 09:14:24 -0700

+| 62    | vary                             | origin                                                |
+| 63    | :status                          | 100                                                   |
+| 64    | :status                          | 103                                                   |
+| 65    | :status                          | 204                                                   |
+| 66    | :status                          | 206                                                   |
+| 67    | :status                          | 302                                                   |
+| 68    | :status                          | 400                                                   |
+| 69    | :status                          | 403                                                   |
+| 70    | :status                          | 404                                                   |
+| 71    | :status                          | 421                                                   |
+| 72    | :status                          | 425                                                   |
+| 73    | :status                          | 500                                                   |
+| 74    | :status                          | 503                                                   |

Are putting three-character status codes in the static table really necessary?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1355#pullrequestreview-156448586

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 18 Sep 2018 09:16:40 -0700

> +| 70    | :status                          | 404                                                   |
+| 71    | :status                          | 421                                                   |
+| 72    | :status                          | 425                                                   |
+| 73    | :status                          | 500                                                   |
+| 74    | :status                          | 503                                                   |
+| 75    | accept-ranges                    | bytes                                                 |
+| 76    | access-control-allow-credentials | FALSE                                                 |
+| 77    | access-control-allow-credentials | TRUE                                                  |
+| 78    | access-control-allow-headers     | *                                                     |
+| 79    | access-control-allow-headers     | cache-control                                         |
+| 80    | access-control-allow-headers     | content-type                                          |
+| 81    | access-control-allow-headers     | x-requested-with                                      |
+| 82    | access-control-allow-methods     | get                                                   |
+| 83    | access-control-allow-methods     | get, post, options                                    |
+| 84    | access-control-allow-methods     | options                                               |
+| 85    | access-control-allow-origin      | *                                                     |

All of the above are response headers; is it worth having so many variations?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1355#pullrequestreview-156449553

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 18 Sep 2018 09:17:09 -0700

+| 85    | access-control-allow-origin      | *                                                     |
+| 86    | access-control-expose-headers    | content-length                                        |
+| 87    | access-control-request-headers   | content-type                                          |
+| 88    | access-control-request-headers   | x-requested-with                                      |
+| 89    | access-control-request-method    | get                                                   |
+| 90    | access-control-request-method    | post                                                  |
+| 91    | alt-svc                          | clear                                                 |
+| 92    | content-encoding                 | gzip                                                  |
+| 93    | content-security-policy          | script-src 'none'; object-src 'none'; base-uri 'none' |
+| 94    | early-data                       | 1                                                     |
+| 95    | expect-ct                        |                                                       |
+| 96    | forwarded                        |                                                       |
+| 97    | if-range                         |                                                       |
+| 98    | origin                           |                                                       |
+| 99    | purpose                          | prefetch                                              |

This is going away AIUI.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1355#pullrequestreview-156449878

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 18 Sep 2018 09:17:51 -0700

+| 74    | :status                          | 503                                                   |

People using this header usually don't understand what they're getting; e.g., they use it for access control. 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1355#pullrequestreview-156450193

---

From: MikkelFJ <[email-masked]>
Date: Tue, 18 Sep 2018 09:44:58 -0700

mikkelfj commented on this pull request.

+| 74    | :status                          | 503                                                   |

I don't remember what it means 5 minutes after I read about it due to lack of hint of intuition, but CORS is used a lot, especially in CDN, so it makes a lot of sense to have, if it it means what I think it means.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1355#discussion_r218508649

---

From: Mike Bishop <[email-masked]>
Date: Fri, 28 Sep 2018 11:09:31 -0700

@MikeBishop pushed 1 commit.

bd85b56  Incorporating final feedback

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/1355/files/98c7db27c50b7207c6313aa2f3c00b1a3767df06..bd85b56afc06192400b58904d41a6f2c7f851f97

---

From: Mike Bishop <[email-masked]>
Date: Fri, 28 Sep 2018 11:15:51 -0700

89d5748  Escape \*, again

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/1355/files/bd85b56afc06192400b58904d41a6f2c7f851f97..89d5748301c69aeda8925b7b3fb82f4476905906