Re: [Doh] [Ext] DoH client-server interoperability vs. strict HTTP parameter checking

[bert hubert <[e-mail]>]

On Sat, Jun 01, 2019 at 04:08:30PM +0000, Mark Delany wrote:
> Surely a server has to expect that it will eventually be talking to a
> client from the future which will, by definition, be adding unknowable
> parameters.

And in the DNS world we've often let clients know we don't get their
newfangled speak (FORMERR).  Silently ignoring unexpected parameters is a
great way to proliferate half-working configurations.  "Did
parentalcontrol=0&malwarefilter=1 get accepted or not?  I have no idea".

Secondly, the accepting nature of most HTTP services has created reams of
tracking possibilities, viz utm_source and fbclid which now get tacked
on at random and track you even if you copy paste the URL to someone.

So in short, I would not go out and recommend that servers simply ignore
unknown parameters. They might accidentally do it but it fosters bad things
like silent errors & even more tracking than cookies, TLS resumption tickets
and HTTPS agent headers already bring.

	Bert