[CDNi] draft-ietf-cdni-edge-control-metadata-00 submitted. Response to comments

[ALFONSO SILONIZ SANDINO <[e-mail]>]

Hello,

Draft-ietf-cdni-edge-control-metadata-00 has just been submitted replacing draft-siloniz-cdni-edge-control-metadata after WG adoption. We have addressed all comments received in the list by Kevin Ma (thanks). This is the list of comments and how we have addressed them.


section 1: spell out CORS on first use
*** Response: FIXED

section 3: remove duplicate sentence: "Set a default value for CORS response headers independent of the origin request header value."
*** Response: FIXED ***

section 3: it's not clear to what "the player" refers. this is the first mention of a "player".
*** Response: FIXED: Changed "set to the URL domain of the webpage that the player runs" to "set to a URL domain of the webpage from which the User Agent made it. "

section 3: remove duplicate sentence: "Validation of the origin header - Metadata can include a list of valid domains to validate the request origin header. If it does not match, the CORS header MUST NOT be included in the response."
*** Response: FIXED

section 3: "the OCN SHOULD" -> "the dCDN SHOULD"
*** Response: FIXED

section 3: remove duplicate phrase: "Allowed methods"
*** Response: Fixed

section 3: "for the specification of dynamically generated CORS headers" -> "specifying how to dynamically generate CORS headers" or "configuring..."
*** Response: FIXED: Changed to "configuring dynamically generated CORS headers"

section 3: "values the OCN will" -> "values the dCDN will"
*** Response: FIXED

section 3: when the MtS is "No", does the dCDN omit the header or include the header with no values?
*** Response: FIXED Added the following in all the properties default: . "If not specified, the default behavior is to not add the header in the response" and in the "no-origin-response-headers" the following: "If not specified, the default behavior is to not add any CORS response headers"

section 3, "allow-origin" type: add a reference for "MI.AccessControlAllowOrigin"
*** Response: FIXED Added an internal reference.

section 3, "no-origin-response-headers" type: add a reference for "MI.HTTPHeader"
*** Response: FIXED As ProcessingStages is not yet a WG document, linked to SVTA document

section 3: "apply-to-all-methods" -> "all-methods" ?
*** Response: We changed the property name AND its meaning. Now it is called preflight-only

section 3.1, "allow-list" description: "requests, and" -> "requests and"
*** Response: FIXED

section 3.1, "allow-list" description: "Permitted values are" -> "Permitted values are of the form" ? perhaps a reference to RFC3986
*** Response: FIXED Added reference to RFC3986 for schema://host[:port]

section 3.1, "allow-list" type: why is this using PatternMatch objects? the description says "schema://hostname[:port]", but PatternMatch is only for uri paths (https://datatracker.ietf.org/doc/html/rfc8006#section-4.1.4)? Endpoint would be closer, but doesn't include schema (https://datatracker.ietf.org/doc/html/rfc8006#section-4.3.3).
*** Response: FIXED. We have used a more simple definition for this.

section 3.1, "wildcard-return" description: "the OCN will" -> "the dCDN MUST"
*** Response: FIXED

section 3.1: move examples to a separate section.
*** Response: FIXED Added a subchapter for the examples, to separate from the previous section.

section 3.1: is the allow-list safe-to-redistribute (per: https://datatracker.ietf.org/doc/html/rfc8006#section-3.2) ?
*** Response: I don´t see any problem on it. The goal of this object in general is to allow a server in the Edge to generate headers responses. So the dCDN is the ultimate destination of this list. An intermediate CDN can be able to redistribute the list even if it does not support the property, so the default value of safe-to-redistribute is good.

section 4, "allow-compress" description: "the dCDN will" -> "the dCDN MUST"
*** Response: FIXED This option is a try. The dCDN can or can not do it depending of its implementation. Changed to SHOULD

section 4, "allow-compress" type: can probably remove "The values are "True" or "False"."
*** Response: FIXED

section 4, examples: is the "Processing Stages" necessary? is it enough just to give an example of the "MI.AllowCompress" encoding?
*** Response: FIXED Moved to a new section called Informative Examples, and referencing the SVTA document

section 5: i don't understand this assertion: "Since the clients are typically owned/operated by a uCDN..." ? how are we defining "client" here? is it not just a web browser? there is a subsequent reference to "players", but that is not clearly defined. if the metadata itself is generic, and can be applied to anything, this discussion of players and ownership may not be necessary.
*** Response: FIXED: Changed to: " In some use cases, like video streaming or other critical object delivery, UA applications connection to the cache server must be in control to have the best user experience possible. This metadata allows a uCDN to accommodate device-specific constraints and performance optimization"

section 5: "how a dCDN manages" -> "how a dCDN SHOULD manage" ?
*** Response: FIXED

section 6: i don't think a conclusion is necessary.
*** Response: removed

section 8.1: this obviously needs to be filled out
*** Response: Fixed

________________________________

Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción.

The information contained in this transmission is confidential and privileged information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it.

Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição
________________________________

Le informamos de que el responsable del tratamiento de sus datos es la entidad del Grupo Telefónica vinculada al remitente, con la finalidad de mantener el contacto profesional y gestionar la relación establecida con el destinatario o con la entidad a la que está vinculado. Puede contactar con el responsable del tratamiento y ejercitar sus derechos escribiendo a [e-mail]<mailto:[e-mail]>. Puede consultar información adicional sobre el tratamiento de sus datos en nuestra Política de Privacidad<https://www.telefonica.com/es/telefonica-politica-de-privacidad-de-terceros/>.

We inform you that the data controller is the Telefónica Group entity linked to the sender, for the purpose of maintaining professional contact and managing the relationship established with the recipient or with the entity to which it is linked. You may contact the data controller and exercise your rights by writing to [e-mail]<mailto:[e-mail]>. You may consult additional information on the processing of your data in our Privacy Policy<https://www.telefonica.com/en/wp-content/uploads/sites/5/2022/12/Telefonica-Third-data-subjects-Privacy-Policy.pdf>.

Informamos que o responsável pelo tratamento dos seus dados é a entidade do Grupo Telefónica vinculada ao remetente, a fim de manter o contato professional e administrar a relação estabelecida com o destinatário ou com a entidade à qual esteja vinculado. Você pode entrar em contato com o responsável do tratamento de dados e exercer os seus direitos escrevendo a [e-mail]<mailto:[e-mail]>. Você pode consultar informação adicional sobre o tratamento do seus dados na nossa Política de Privacidade<https://www.telefonica.com/es/politica-de-privacidade-de-terceiros/>.