Subject: Re: [websec] Last Call: <draft-ietf-websec-origin-04.txt> (The Web Origin Concept) to Proposed Standard

From: Adam Barth <[email-masked]>
Date: Fri, 2 Sep 2011 03:20:28 -0700

I replied to Julian's message on a W3C list.  Julian, is there more
discussion you'd like to have about these points?

Adam

On Thu, Aug 25, 2011 at 9:32 AM, Julian Reschke <[email-masked]> wrote:
> Below a few late comments..
>
> 6. Serializing Origins
>
> - It really really seems that the two algorithms need to be swapped (the
> first one converts to ASCII, but the second does not).
>
> - Also, I'd prefer a declarative definition.
>
> 7. The HTTP Origin header
>
> - header *field*
>
> - the syntax doesn't allow multiple header fields, and the prose says
> clients MUST NOT generate them; what is the recipient supposed to do when it
> get's multiple instances anyway? Is the default approach (ignoring them all)
> good enough? Do we need to warn recipients so that they check?
>
> 11. References
>
> - the WEBSOCKETS reference should be updated (if a new draft is produced)
>
> Best regards, Julian
> _______________________________________________
> websec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/websec
>

---

From: Julian Reschke <[email-masked]>
Date: Fri, 02 Sep 2011 12:26:23 +0200

On 2011-09-02 12:20, Adam Barth wrote:
> ...

Well, as discussed, the syntax of the Origin header makes it hard to 
detect errors which happen when multiple instances get folded into one; 
see 
<http://greenbytes.de/tech/webdav/draft-ietf-httpbis-p2-semantics-latest.html#considerations.for.creating.header.fields> 
-- but I fear it's too late to fix this?

Best regards, Julian

---

From: "Roy T. Fielding" <[email-masked]>
Date: Fri, 2 Sep 2011 12:38:58 -0700

On Aug 23, 2011, at 2:19 PM, The IESG wrote:

> The IESG has received a request from the Web Security WG (websec) to
> consider the following document:
> - 'The Web Origin Concept'
>  <draft-ietf-websec-origin-04.txt> as a Proposed Standard

Sec 2.2: the definition of OWS includes a mistake that I just fixed in httpbis.

   OWS            = *( [ obs-fold ] WSP )
                    ; "optional" whitespace
   obs-fold       = CRLF

should be

   OWS            = *( HTAB / SP / obs-fold )
                    ; "optional" whitespace
   obs-fold       = CRLF ( HTAB / SP )
                    ; obsolete line folding

The problem isn't in OWS itself -- the above are equivalent.
It is the definition of obs-fold that is wrong because it stands
for the obsolete line folding allowed by RFC2616 (RFC822, etc.).
A CRLF alone is not an obs-fold, so optimizing the ABNF in that
way was wrong in httpbis.  Likewise, I recommend replacing WSP with
its equivalent ( HTAB / SP ) because the name is misleading and
is only used in this one section.

OTOH, perhaps a simpler change is in order.  The above definitions
are only used once in the document (Section 7.1).  Furthermore,
since we are defining a new header field (and not all header fields),
we can be more proscriptive in 7.1 and remove the section above.

In 7.1, instead of

   origin              = "Origin:" OWS origin-list-or-null OWS

define it as

   origin              = "Origin:" [ SP ] origin-list-or-null

and then most of 2.2 can be removed.

Sec 8: typo:  s/those model /those models /

Otherwise, the spec looks good.

Cheers,

Roy T. Fielding                     <http://roy.gbiv.com/>
Principal Scientist, Adobe Systems  <http://adobe.com/enterprise>

---

From: "Roy T. Fielding" <[email-masked]>
Date: Fri, 2 Sep 2011 14:15:12 -0700

On Sep 2, 2011, at 1:19 PM, Frank Ellermann wrote:

> On 2 September 2011 21:38, Roy T. Fielding wrote:
> 
> [http-bis]
> Clearer.  JFTR, this is still "avoid *any* folding", and not
> "avoid more than one folding".

That is the intention.  There is no reason to fold in HTTP
outside of the message/http media type.

>  And if you like...
> ...I wonder why you don't demote HTAB generally to "obsolete"
> in OWS.

We already state that a single SP is preferred.

> Or why you don't propose *WSP instead of [SP] in the
> Origin header field.

Because a single SP is preferred.  This is a new header field.

> It would be odd if the overall HTTPbis
> rules and the specific Origin header field have different
> ideas about "optional white space" (modulo <obs-fold>, i.e.,
> eliminating <obs-fold> in a new header field Origin is fine).

The overall field parsing rules for HTTPbis are for recipients.
These things are parsed in general, and so it only matters that
the generative grammar for origin matches one of the choices
allowed by the parsing grammar in HTTPbis.

> One optional SP is not the same as zero or more ( HTAB / SP ).

It is if you only send the preferred format.  That said, I'd also
agree with Julian's suggestion that it is better to just define
the field-value in ABNF and leave the rest to HTTP.

....Roy

---

From: Frank Ellermann <[email-masked]>
Date: Fri, 2 Sep 2011 22:19:34 +0200

[http-bis]

Clearer.  JFTR, this is still "avoid *any* folding", and not
"avoid more than one folding".  And if you like...

...I wonder why you don't demote HTAB generally to "obsolete"
in OWS.  Or why you don't propose *WSP instead of [SP] in the
Origin header field.  It would be odd if the overall HTTPbis
rules and the specific Origin header field have different
ideas about "optional white space" (modulo <obs-fold>, i.e.,
eliminating <obs-fold> in a new header field Origin is fine).

-Frank

---

From: Frank Ellermann <[email-masked]>
Date: Sat, 3 Sep 2011 00:20:51 +0200

On 2 September 2011 23:15, Roy T. Fielding wrote:

>> this is still "avoid *any* folding", and not "avoid more
>> than one folding".

> outside of the message/http media type.

As a result you get an intentional difference from <obs-FWS>
in messages, because HTTP has no line length limit.  This
<obs-FWS> is about "insane" foldings, and your <obs-fold> is
about "unnecessary or insane" foldings.

I'm not sure that a sound but unnecessary folding is really
always a bad idea, e.g., I don't use programming languages
with a hardwired maximal string length, where "unnecessary"
could turn out to be "rarely almost required".

Still only "JFTR", if you are sure that this is precisely as
you want it stick to it.  The more spectacular examples with
"syntactically valid ASCII art consisting of commas" will be
obsoleted by <obs-fold>, while <obs-FWS> alone only tackles
the dangerous "apparently empty" lines -- but IIRC RFC 5322
also did something else about ASCII art.

>> I wonder why you don't demote HTAB generally to "obsolete"
>> in OWS.

> We already state that a single SP is preferred.

Two SHOULDs in the prose before the syntax.  If you move HTAB
to obs-fold = HTAB / ( CRLF (HTAB / SP)) and then rename this
to <obs-wsp> it would more closely match the prose, "whatever
you do with one or even more than one SP, stay away from HTAB
and CRLF".

> That said, I'd also agree with Julian's suggestion that it
> is better to just define the field-value in ABNF and leave
> the rest to HTTP.

Yes, the Origin I-D shouldn't define any <OWS> if that is not
guaranteed to be precisely the same as in the future HTTPbis.

-Frank

---

From: Adam Barth <[email-masked]>
Date: Sat, 3 Sep 2011 12:13:01 -0700

> is only used in this one section.

This text is intended to match the text from HTTPbis.  The most
recently published HTTPbis documents still contain the old
construction:

http://tools.ietf.org/html/draft-ietf-httpbis-p1-messaging-16#section-1.2.2

Is there some way to see the as-yet-unpublished version with the
updated text so I can make sure to get it exactly right?

> and then most of 2.2 can be removed.

Is there some advantage in doing that?  It seems better to define this
header in the same way we define all the other headers.  If we do
something different here, we run the risk of confusing folks into
thinking that it requires some sort of different generation or parsing
than everything else.

> Sec 8: typo:  s/those model /those models /

Fixed.

> Otherwise, the spec looks good.

Thanks!

Adam

---

From: Adam Barth <[email-masked]>
Date: Sat, 3 Sep 2011 12:16:34 -0700

On Fri, Sep 2, 2011 at 3:26 AM, Julian Reschke <[email-masked]> wrote:
> Well, as discussed, the syntax of the Origin header makes it hard to detect
> errors which happen when multiple instances get folded into one; see

Unfortunately, yes.  Adding quotes would break the large number of
folks using already using this header.

Adam

---

From: Julian Reschke <[email-masked]>
Date: Sun, 04 Sep 2011 22:00:42 +0200

On 2011-09-03 21:13, Adam Barth wrote:
> On Fri, Sep 2, 2011 at 12:38 PM, Roy T. Fielding<[email-masked]>  wrote:

<http://trac.tools.ietf.org/wg/httpbis/trac/browser/draft-ietf-httpbis/latest/p1-messaging.html>

But then, this is still work-in-progress.

> thinking that it requires some sort of different generation or parsing

The best way to do it (as Roy agreed as well) is just to define the ABNF 
for the field-value.

Best regards, Julian