Re: [apps-discuss] I-D Action: draft-nottingham-http-browser-hints-02.txt

[Mykyta Yevstifeyev <[e-mail]>]

31.08.2011 17:53, Barry Leiba wrote:
>>>> I understand that HSTS is only useful when site declares that HTTPS must
>>>> be used any time when connecting to it.  Specific areas/resources may
>>>> not be declared to be so (If I'm wrong, correct me).
>>> What is the use case for that feature?
>> This provides a way for client which prefers to use secure variant to learn
>> which areas of the site are fine to be accessed so, without attempting to
>> use HTTPS where it isn't possible.
> Let me see if I understand this correctly:
>
> A client that wants to use HTTPS, but isn't sure whether this part of
> the site supports it, can do it one of two ways:
>
> 1. Try HTTPS.  If it doesn't work, fall back to HTTP.
>
> 2. Use HTTP.  If a "hint" is included in the HTTP response that says
> HTTPS is OK, then switch to HTTP.
>
> You're proposing 2.  Is that right?
>
> Assuming that's right, I'm saying that 1 is better.

You're right.  But: a client needs to do 1 for each time it tries to 
access something whereas 2 would only be required once.  2 is more 
practical; are there any other considerations which led you to the 
conclusion that 1 is better?

Mykyta

>
> Barry
>