Re: [httpwg/http-extensions] Stream-linking frames can reference Stream Zero (#586)

[HTTP issue updates <[e-mail]>]

MikeBishop commented on this pull request.



>  
-If the server does not have the desired certificate, it MUST \[see issue #564].
-In this case, or if the server has not advertised support for HTTP-layer
-certificates, the client MUST NOT send any requests for resources in that origin
-on the current connection.
+If the server does not have the desired certificate, it MUST send an empty
+`USE_CERTIFICATE` frame for stream zero.  In this case, or if the server has not

Actually, "empty" probably needs to be clarified here.  In the previous draft (i.e. where things were on-stream with the request), you could omit the CertID and send a USE_CERTIFICATE with a length of zero, which meant "I don't have / choose not to provide the requested certificate.  Deal."

If ExpAuth gives us an authenticated denial, I'd be fine using it.  But I'm also fine if it doesn't -- the point of ExpAuth is proving possession, and I think declining to provide an authenticator is sufficient for our purposes.  This isn't DNSsec where we want to authoritatively prove non-existence, we're just declining to supply a certificate (or, therefore, proof of possession).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/pull/586#discussion_r191064735