Subject: RE: [[email-masked]: Re: [dav-dev] Depth Infinity Requests]

From: "Clemm, Geoff" <[email-masked]>
Date: Thu, 6 Jul 2000 10:29:08 -0400

I think we should disallow Depth:infinity on a PROPFIND, and require that
the client pass in some maximum depth to let the server know when it
should stop.

Cheers,
Geoff

-----Original Message-----
From: Greg Stein [mailto:[email-masked]]
Sent: Thursday, July 06, 2000 10:15 AM
To: [email-masked]
Subject: [[email-masked]: Re: [dav-dev] Depth Infinity Requests]

What is the general consensus on PROPFIND with Depth: infinity? I quoted a
couple messages below that tend to favor disallowing them. I got that
impression from some other comments on this list, but couldn't find specific
references.

For clarity: can prople give opinions on simply disabling PROPFIND infinity?

JimW: we should probably note (explicitly) in the spec that a server may
return a 403 (Forbidden) if a client requests a PROPFIND with a Depth of
infinity.

[ I believe everybody is probably okay with returning a 403 (Forbidden) in
  certain cases. My question is more along the lines of outright shutting it
  off before beginning to walk the repository to see what is up. ]

Cheers,
-g

----- Forwarded message from Hartmut Warncke <[email-masked]> -----

Date: Wed, 05 Jul 2000 13:55:39 +0200
From: Hartmut Warncke <[email-masked]>
Reply-To: [email-masked]
To: Greg Stein <[email-masked]>
CC: Mod_dav Mailing List <[email-masked]>
Subject: Re: [dav-dev] Depth Infinity Requests

> I am having a hard time locating the specific discussions (I believe there
> have been a couple) in the archives regarding PROPFIND infinity requests.
I
> have found two references so far:
>
>     http://lists.w3.org/Archives/Public/w3c-dist-auth/1999AprJun/0062.html
>     http://lists.w3.org/Archives/Public/w3c-dist-auth/1999AprJun/0071.html
>
> Take a look at the end of each of these notes.
>

At the end of the second note I found a statement of Jim Whitehead:

"As a result, a conservative client should never perform a PROPFIND, depth
infinity unless it knows the namespace it is issuing the PROPFIND against,
and a server should be free to refuse to process a PROPFIND, depth infinity
if it would result in too large a response (since this could easily be used
to implement a denial of service attack). Both of these approaches are
allowed by the specification."

I do not understand the last sentence because I did not find anything about
that issue in RFC 2518 (Did I miss something?). I think the information that
a
server
can refuse a depth infinity request is a very important information which
should

be included in RFC2518?!

Hartmut

----- End forwarded message -----

-- 
Greg Stein, http://www.lyra.org/

---

From: "Dylan Barrell" <[email-masked]>
Date: Thu, 6 Jul 2000 11:15:08 -0400

I agree - Having only 0, 1 and infinity is restrictive and infinity can be a
real problem on large sites.

> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Clemm, Geoff
> Sent: Thursday, July 06, 2000 10:29 AM
> To: [email-masked]
> Subject: RE: [[email-masked]: Re: [dav-dev] Depth Infinity Requests]
>
>

be included in RFC2518?!

Hartmut

---

From: Hartmut Warncke <[email-masked]>
Date: Thu, 06 Jul 2000 17:22:40 +0200

I am of the opinion that disallowing  depth infinity PROPFINDS
would cut off one of the main WebDAV features.  In order to
explain that opinion I  would  like to give you a short example
how we use WebDAV in Adobe GoLive 5.0 (the following sample
is not a theoretical one it's out of the everday life of a GoLive user):

Imagine that you need the modification dates of  1000 resources
on the server in order to synchronize the resources on the server
with the resources on your local machine. Even if the resources
are located in a directory with a very deep hierarchy it's not a
problem with a depth infinity PROPFIND. You ask the server for
the dates and get the response for all the 1000 resources within one
Network request/ response.

On the other hand if you stick to PROPFIND Depth: 1 you end up
in a tremendous drawback (a ftp-like solution) because the client
software has to go down the hierarchy step by step and ask for the
content of each directory  level. The User has  to be very patient
in that scenario ...

So to my mind the infinity PROPFIND is a main WebDAV feature
for practical purposes.

In addition to that I would like to draw your attention to the fact
that it is very difficult to base a software implementation on a
WebDAV RFC which changes frequently because we are not able
to ship a new Release of our software every two weeks.

Hartmut

---

From: Kevin Wiggen <[email-masked]>
Date: Thu, 06 Jul 2000 09:27:35 -0700

I believe we should follow the DASL spec on this one.  Dasl allows a server
to send a 507 if the query produced more results than the server is willing
to transmit.  Partial Results have been transmitted.

This is the implementation on the Xythos Storage Server for both SEARCH and
PROPFIND.

Kevin

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Hartmut Warncke
Sent: Thursday, July 06, 2000 8:23 AM
To: WebDAV WG
Subject: Re: [[email-masked]: Re: [dav-dev] Depth Infinity Requests]

Hartmut