Subject: [quicwg/base-drafts] Require 8164 validation for non-https origins (#2973)

From: Mike Bishop <[email-masked]>
Date: Fri, 16 Aug 2019 10:52:30 -0700

Fixes #2439 in what I believe is the simplest way possible -- point to 8164 and require that `http-opportunistic` be successfully retrieved prior to sending any scheme other than `https`.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/2973

-- Commit Summary --

  * Require 8164 validation for non-https origins

-- File Changes --

    M draft-ietf-quic-http.md (4)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/2973.patch
https://github.com/quicwg/base-drafts/pull/2973.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2973

---

From: Martin Thomson <[email-masked]>
Date: Wed, 21 Aug 2019 17:13:37 -0700

martinthomson commented on this pull request.

> @@ -381,6 +381,10 @@ certificate for the origin before considering it authoritative. Clients MUST NOT
 assume that an HTTP/3 endpoint is authoritative for other origins without an
 explicit signal.
 
+If the client intends to make requests for an origin containing a scheme other
+than "https", it MUST also obtain a valid `http-opportunistic` response for the

I think that this requirement only applies to the "http" scheme.  It would not apply to the "ni" scheme, for instance.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2973#pullrequestreview-278135489

---

From: Mike Bishop <[email-masked]>
Date: Wed, 21 Aug 2019 17:36:10 -0700

MikeBishop commented on this pull request.

I'm of split opinion on that.  On the one hand, "http-opportunistic" is defined for "http"; on the other hand, you still really want to know that the connection is capable of handling a non-https URI scheme before you send it.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2973#discussion_r316456277

---

From: Martin Thomson <[email-masked]>
Date: Wed, 21 Aug 2019 18:18:12 -0700

Yes, but the point of this is to point at a specific mechanism, which only applies to "http".  I'd be OK with leaving an impression that other protocols might need similar checks, that might be OK with me, but coming right out and saying that they definitely do is a bit of a big deal.

Saying that they have to use the HTTP mechanism is just wrong.  Part of the way in which that mechanism was designed was in response to HTTP-specific problems.  I'm sure that HTTP isn't unique in this regard, but it doesn't mean that you can't just start using "new-uri-scheme" without additional safeguards if that scheme was designed that way.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2973#discussion_r316463068

---

From: MikkelFJ <[email-masked]>
Date: Thu, 22 Aug 2019 00:50:26 -0700

mikkelfj commented on this pull request.

I agree to what @martinthomson says. Unrelated and yet related I just fought (and lost) the Google Layer 7 load balancer because it insisted doing http health checks on a port that speaks websockets but does not serve http pages on the same port. In my case a tcp health check would have worked, but the point is that assuming that everything is http is not good.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2973#discussion_r316539631

---

From: Mike Bishop <[email-masked]>
Date: Thu, 22 Aug 2019 08:32:06 -0700

@MikeBishop pushed 1 commit.

ed68fdf589cb8ffd2148759410bdac3e51cf4539  8164 is specific, but the requirement is generic

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/2973/files/7c6d1d63410e962400b5ac6a83f78af7d6d486e0..ed68fdf589cb8ffd2148759410bdac3e51cf4539

---

From: Mike Bishop <[email-masked]>
Date: Thu, 22 Aug 2019 08:32:13 -0700

Try this version.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2973#discussion_r316745333

---

From: Martin Thomson <[email-masked]>
Date: Thu, 22 Aug 2019 17:06:52 -0700

martinthomson approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2973#pullrequestreview-278744588

---

From: Kazuho Oku <[email-masked]>
Date: Thu, 22 Aug 2019 23:48:52 -0700

kazuho approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2973#pullrequestreview-278821642

---

From: Mike Bishop <[email-masked]>
Date: Mon, 26 Aug 2019 11:12:43 -0700

Merged #2973 into master.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2973#event-2584517036