Subject: [quicwg/base-drafts] Clarify what "prohibited header fields" are (#3345)

From: Kazuho Oku <[email-masked]>
Date: Tue, 14 Jan 2020 16:02:01 -0800

[Section 4.1.3 of HTTP draft](https://quicwg.org/base-drafts/draft-ietf-quic-http.html#section-4.1.3) states that _a malformed request or response is one that is an otherwise valid sequence of frames but is invalid due to the presence of extraneous frames, prohibited header fields, the absence of mandatory header fields, or the inclusion of uppercase header field names._

Based on the discussion we have been having in #3300, I think we agree that we mean the connection-specific header fields designated in [section 8.1.2.2 of RFC 7540](https://httpwg.org/specs/rfc7540.html#rfc.section.8.1.2.2).

But in the HTTP/3 draft, I can neither find the corresponding text, or a reference to that part of RFC 7540.

I think we should clarify what the term means.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3345

---

From: Mike Bishop <[email-masked]>
Date: Tue, 14 Jan 2020 16:05:10 -0800

> The restrictions on the use of pseudo-header fields in Section 8.1.2 of [HTTP2] also apply to HTTP/3.

This also feeds into #3264, which suggests those prohibitions should be local to the document.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3345#issuecomment-574432826

---

From: Kazuho Oku <[email-masked]>
Date: Tue, 14 Jan 2020 16:09:00 -0800

connection-specific header fields (e.g., transfer-encoding) are not pseudo-header fields.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3345#issuecomment-574433905

---

From: Mike Bishop <[email-masked]>
Date: Tue, 14 Jan 2020 16:18:42 -0800

Fair enough.  I think I'd like to generalize this issue:
- Invalid sequences of frames should be connection errors (DATA before HEADERS, multiple non-final HEADERS, possibly multiple trailers modulo #3265)
- Which header fields are prohibited and mandatory needs to be clearly stated; violations of this remain stream errors
- Upper-case field names remain stream errors

Let's make "malformed" more precise, and that should resolve most of our differences on #3300.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3345#issuecomment-574436384

---

From: Mike Bishop <[email-masked]>
Date: Thu, 16 Jan 2020 11:52:52 -0800

@mnot, @larseggert, @LPardue:  The fix to this will not be editorial, because it mandates certain things which were stream errors now become connection errors.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3345#issuecomment-575317282