Subject: RE: driveway.com / cadaver interop

From: Yaron Goland <[email-masked]>
Date: Thu, 27 Jan 2000 13:13:55 -0800

A server is always free to return extra properties since clients are always
able to tell if a response contains the properties they are interested in. A
client that fails in this scenario would be properly viewed as broken as,
even if the standard prohibited returning extra properties, a real world
client MUST be flexible enough to handle a broken server that did the wrong
thing in this case.

That having been said, I wouldn't support specifying that a server MUST NOT
return extra properties as I don't think this requirement would enhance
interoperability and it would prevent some potentially useful scenarios.

I realize that a server returning extra properties could be considered a
D.O.S. attack but since the server is the "service" and since the client can
kill the TCP connection, I find this argument to be a bit strained.

> -----Original Message-----
> From: Joe Orton [mailto:[email-masked]]
> Sent: Thursday, January 27, 2000 11:34 AM
> To: [email-masked]
> Cc: [email-masked]
> Subject: driveway.com / cadaver interop
> 
> 
> In the response to a PROPFIND with the following body:
> 
> <?xml version="1.0"?>
> <propfind xmlns="DAV:">
>   <prop><getcontentlength/><getlastmodified/><resourcetype/></prop>
> </propfind>
> 
> the driveway.com server will include the DAV:supportedlock element for
> non-collection resources, which seems wrong, although I can't find
> anywhere in 2518 which actually says so. There should be some kind of
> requirement that servers only return the *requested* 
> properties for this
> type of PROPFIND requests, shouldn't there? A MUST 
> requirement would be
> nice.
> 
> joe
>

---

From: Joe Orton <[email-masked]>
Date: Sat, 29 Jan 2000 15:19:09 +0000

Does the WG still want to be seeing these reports?

Further testing against www.driveway.com: 

MKCOL fails with 500 internal server error, e.g.:

MKCOL /user.jorton/bar/ HTTP/1.1
User-Agent: cadaver/0.10.0
Connection: Keep-Alive
Host: www.driveway.com
Authorization: xxxxxxxxxxxxxxxxxxxxxxxxxx

COPY returns 204, but doesn't actually copy anything: e.g.

COPY /user.jorton/foo.htm HTTP/1.1
User-Agent: cadaver/0.10.0
Connection: Keep-Alive
Host: www.driveway.com
Destination: http://www.driveway.com/user.jorton/bar.htm
Overwrite: F
Authorization: xxxxxxxxxxxxxxxxxxxxxxxxxx

A GET or PROPFIND against a collection which doesn't exist returns 422,
should be 404.

Regards,

joe

---

From: Joe Orton <[email-masked]>
Date: Sat, 29 Jan 2000 16:01:31 +0000

> interoperability and it would prevent some potentially useful scenarios.

The fact that the spec is silent on this point has caused this interop
problem; it needs to say something, whether it is MUST NOT or SHOULD NOT
or just a comment.

joe