Re: [httpapi] Using Date in requests

[Martin Thomson <[e-mail]>]

Yeah, it seems like this is one of the major revelations from this discussion.  That is, that times (or dates) might appear in multiple places and the considerations here aren't limited to the Date field.

Any input regarding text would be greatly appreciated.  I'll get around to doing something eventually, but my todo list keeps growing.

On Sat, Feb 12, 2022, at 02:17, James wrote:
> Hi Martin,
> Thanks for writing this up. I'm unsure if this was discussed elsewhere, 
> but another consideration about the Date header is its off-label use 
> for rough time synchronisation - in particular, phk wrote an 
> implementation[1], and later a rough specification[2] with an entry in 
> the well-known registry[3] using a different header aimed to either 
> synchronise, or validate a local clock. I both hope and doubt nobody is 
> using this approach, but its existence leads me to think that some 
> overall guidance on how people transmit time information more broadly 
> in HTTP messages and rely on it might be helpful for your audience. 
> Happy to help write that.
>
> - J
>
> 1: http://phk.freebsd.dk/time/20151212/
> 2: http://phk.freebsd.dk/time/20151129/
> 3: https://www.iana.org/assignments/well-known-uris/well-known-uris.xhtml
>
>> On 9 Feb 2022, at 06:29, Martin Thomson <[e-mail]> wrote:
>> 
>> Hi Everyone,
>> 
>> I've just posted https://www.ietf.org/archive/id/draft-thomson-httpapi-date-requests-00.html which talks about how to use Date in requests.  This is not a typical thing you see, but some of the things we're doing elsewhere makes this relevant.  For example, signing requests [1] and oblivious HTTP [2] - depending on circumstances - might want to use Date for managing anti-replay.
>> 
>> I'm bring this here as I think that this group has more direct expertise and the work is related to some of the other stuff you are doing, like the idempotency-key, which is complementary.  This also uses the problem details work (RFC 7807bis) for signaling when Date is missing or incorrect.
>> 
>> I'm happy to go into the use case in more detail if the content of the draft isn't clear enough.  Mostly, I'm just doing this so  there is a complete and robust solution for how to manage replay for the aforementioned work.
>> 
>> Cheers,
>> Martin
>> 
>> 
>> [1] https://httpwg.org/http-extensions/draft-ietf-httpbis-message-signatures.html
>> [2] https://ietf-wg-ohai.github.io/oblivious-http/draft-ietf-ohai-ohttp.html
>> 
>> -- 
>> httpapi mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/httpapi