Subject: [[email-masked]: Re: [dav-dev] Depth Infinity Requests]

From: Greg Stein <[email-masked]>
Date: Thu, 6 Jul 2000 07:15:11 -0700

What is the general consensus on PROPFIND with Depth: infinity? I quoted a
couple messages below that tend to favor disallowing them. I got that
impression from some other comments on this list, but couldn't find specific
references.

For clarity: can prople give opinions on simply disabling PROPFIND infinity?

JimW: we should probably note (explicitly) in the spec that a server may
return a 403 (Forbidden) if a client requests a PROPFIND with a Depth of
infinity.

[ I believe everybody is probably okay with returning a 403 (Forbidden) in
  certain cases. My question is more along the lines of outright shutting it
  off before beginning to walk the repository to see what is up. ]

Cheers,
-g

----- Forwarded message from Hartmut Warncke <[email-masked]> -----

Date: Wed, 05 Jul 2000 13:55:39 +0200
From: Hartmut Warncke <[email-masked]>
Reply-To: [email-masked]
To: Greg Stein <[email-masked]>
CC: Mod_dav Mailing List <[email-masked]>
Subject: Re: [dav-dev] Depth Infinity Requests

> I am having a hard time locating the specific discussions (I believe there
> have been a couple) in the archives regarding PROPFIND infinity requests. I
> have found two references so far:
>
>     http://lists.w3.org/Archives/Public/w3c-dist-auth/1999AprJun/0062.html
>     http://lists.w3.org/Archives/Public/w3c-dist-auth/1999AprJun/0071.html
>
> Take a look at the end of each of these notes.
>

At the end of the second note I found a statement of Jim Whitehead:

"As a result, a conservative client should never perform a PROPFIND, depth
infinity unless it knows the namespace it is issuing the PROPFIND against,
and a server should be free to refuse to process a PROPFIND, depth infinity
if it would result in too large a response (since this could easily be used
to implement a denial of service attack). Both of these approaches are
allowed by the specification."

I do not understand the last sentence because I did not find anything about
that issue in RFC 2518 (Did I miss something?). I think the information that a
server
can refuse a depth infinity request is a very important information which should

be included in RFC2518?!

Hartmut

----- End forwarded message -----

-- 
Greg Stein, http://www.lyra.org/

---

From: Jim Davis <[email-masked]>
Date: Thu, 06 Jul 2000 13:08:39 -0700

>For clarity: can prople give opinions on simply disabling PROPFIND infinity?

I oppose disabling infinity.  it is useful (as other emails have shown).

I agree to adding a principled way to refuse a request that's too expensive.

---

From: "Jim Doubek" <[email-masked]>
Date: Thu, 6 Jul 2000 13:32:17 -0700

Hi,

Note that for realistic sized repositories, say 50K to 100K files, any
depth=infinity request near the repository root is going to be too
expensive. For instance, an allprop request in such a case will be several
to tens of megabytes, and may take minutes to produce.

While it may be convenient for clients going against small repositories, I'd
expect that most servers will fail most infinity requests most of the time.

I think a lot of the uses that people envision for depth=infinity are more
likely served by intelligent tree-walking, or by DASL. The possiblility of
failure forces you to code a tree-walk into your client anyways.

- jim
------------------------------------------
Jim Doubek
Macromedia, Inc.
[email-masked]
http://www.macromedia.com/

    -----Original Message-----
    From: [email-masked]
    [mailto:[email-masked]]On Behalf Of Jim Davis
    Sent: Thursday, July 06, 2000 1:09 PM
    To: Greg Stein; [email-masked]
    Subject: Re: [[email-masked]: Re: [dav-dev] Depth Infinity Requests]

    I agree to adding a principled way to refuse a request that's
    too expensive.

---

From: "Dylan Barrell" <[email-masked]>
Date: Thu, 6 Jul 2000 16:44:03 -0400

And an intelligent client might be able to make n depth requests based on 0
or 1 depth responses that are useful and will not fail where an infinity
request would...

Cheers
Dylan

> [mailto:[email-masked]]On Behalf Of Jim Doubek
> Sent: Thursday, July 06, 2000 4:32 PM
> To: Jim Davis; Greg Stein; [email-masked]
> Subject: RE: [[email-masked]: Re: [dav-dev] Depth Infinity Requests]
>
>
> Hi,
>

---

From: Jim Whitehead <[email-masked]>
Date: Fri, 7 Jul 2000 09:26:04 -0700

> return a 403 (Forbidden) if a client requests a PROPFIND with a Depth of

OK, I've noted this as issue "PROPFIND_INFINITY" at the end of the WebDAV
Distributed Authoring Protocol issues list:

http://www.ics.uci.edu/pub/ietf/webdav/protocol/issues.html

- Jim