If header evaluation on MOVE request with both source and destination resources locked

Ken Murchison <murch@fastmail.com> Thu, 28 May 2026 15:36 UTC

Received: by mail2.ietf.org (Postfix) id 3062AF6B9FDF; Thu, 28 May 2026 08:36:53 -0700 (PDT)
Delivered-To: ietfarch-httpbisa-archive-bis2juki@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 2CBADF6B9FD4 for <ietfarch-httpbisa-archive-bis2Juki@mail2.ietf.org>; Thu, 28 May 2026 08:36:53 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1779982613; bh=uV2qJ3/bnKNThD/403asT6MxiUnv/yEkC3WqHB9IZDo=; h=Resent-From:Resent-Date:Date:From:To:Subject:Resent-Sender: List-Id:List-Help:List-Post:List-Unsubscribe; b=f71h9MGwqxjuDeHBX+W+W0tfpKjCRHPlN/OekFvS3y3+gpxaXPQMZWdnoyyVe6qrI OXTHOkbUWlI8ZzGp9bTo3KnyLXVuNkJ3dHoYfLmms0eREvR55BcooW8oBUDSjwSXEd U6tNtQvPQ51+XtpDK4du+RF1aTLnmKFq2Tdx2N2g=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -5.399
X-Spam-Level:
X-Spam-Status: No, score=-5.399 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=w3.org header.b="K42hiShM"; dkim=pass (2048-bit key) header.d=w3.org header.b="BZf3qpcB"; dkim=pass (2048-bit key) header.d=w3.org header.b="K42hiShM"; dkim=pass (2048-bit key) header.d=w3.org header.b="UbE5MqN9"; dkim=pass (2048-bit key) header.d=fastmail.com header.b="AmfvgM/c"; dkim=pass (2048-bit key) header.d=messagingengine.com header.b="gemJiS8q"
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9qJz6C6agVw1 for <ietfarch-httpbisa-archive-bis2Juki@mail2.ietf.org>; Thu, 28 May 2026 08:36:52 -0700 (PDT)
Received: from mab.w3.org (mab.w3.org [IPv6:2600:1f18:7d7a:2700:d091:4b25:8566:8113]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 6F510F6B9F05 for <httpbisa-archive-bis2Juki@ietf.org>; Thu, 28 May 2026 08:35:50 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=w3.org; s=s1; h=Subject:To:From:MIME-Version:Date:Message-ID:Content-Type:Cc:Reply-To :In-Reply-To:References; bh=cZY1jE+AM+vdNbBOBLIVr/M8qeaaCsZeznOET/AvlcM=; b=K 42hiShMQ2Oz0OtaijHPk5WKtJCmt7ZOLzc2JsVEK4vjGj7Tn9OEouEeQYQp2JIeK/iRQp6OiIbJ9E 7Oc5XiMWbP/XH94Ib2N6X6ohtA3vW1PrUVpOJrovd+uzfo3Srvw75PO0KkZfKHGesvLgaJ6ip8i+C QA9LyAKfcDyTDAplit+o6CbfX1Hw+Hh4IEQVxL6naXh3q/ryRUkOY4mEMHv/Dt8JW5EemFC7Wbz4+ OvmBCRzw/S2a2RV97OrcyGBirbqhhi+q0nSPGkI29O8q6rjnVgzrZUcIhEpLZWiBj/brjJSqJ/FqY TdyBLyRfr/2pD4DjSIVMga9NVya/4vIEA==;
Received: from lists by mab.w3.org with local (Exim 4.96) (envelope-from <ietf-http-wg-request@listhub.w3.org>) id 1wSckk-00EYpa-1p for ietf-http-wg-dist@listhub.w3.org; Thu, 28 May 2026 15:34:34 +0000
Resent-Message-Id: <E1wSckk-00EYpa-1p@mab.w3.org>
Received: from ip-10-0-0-224.ec2.internal ([10.0.0.224] helo=puck.w3.org) by mab.w3.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from <sysbot+mod@w3.org>) id 1wSckj-00EYnu-0Q for ietf-http-wg@listhub.w3.internal; Thu, 28 May 2026 15:34:33 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=w3.org; s=s1; h=Subject:To:From:MIME-Version:Date:Message-ID:Content-Type:Cc:Reply-To :In-Reply-To:References; bh=cZY1jE+AM+vdNbBOBLIVr/M8qeaaCsZeznOET/AvlcM=; t=1779982473; x=1780846473; b=BZf3qpcBNgzdz6wjtGLObJxYbEyiDb34vYV9HLIM+hegar8 MJVC8QVVK/SI/BJTrSE6q1h6gPsfsqQKOmYYxYLEpEOryzThA/nb+Nd+VfrJ6K+DSOTry0MpgRrOz jv9XFDI8iaH3wX+XMD9McmtxJSBnMzd3PS02cs2XzrqTHjhXEXL9wrSM6MYRqGiwNHddMK1VL3Z/I dCH0hp9UO4d2O5qtBsbR9PokHmzvD+YEsAiE9TjHQ/ausRkmneB44LTwNqHpawcFnZC3TZZErXnwR mP3lxLs4HHj4fQ+f+1JavL5xSYuO9QIPpiJK+rytLbwzygY6O+yY7x0rjUpZ986A==;
Received: from mab.w3.org ([2600:1f18:7d7a:2700:d091:4b25:8566:8113]) by puck.w3.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from <sysbot+mod@w3.org>) id 1wSckj-003axe-04 for ietf-http-wg@w3.org; Thu, 28 May 2026 15:34:33 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=w3.org; s=s1; h=Subject:To:From:MIME-Version:Date:Message-ID:Content-Type:Cc:Reply-To :In-Reply-To:References; bh=cZY1jE+AM+vdNbBOBLIVr/M8qeaaCsZeznOET/AvlcM=; b=K 42hiShMQ2Oz0OtaijHPk5WKtJCmt7ZOLzc2JsVEK4vjGj7Tn9OEouEeQYQp2JIeK/iRQp6OiIbJ9E 7Oc5XiMWbP/XH94Ib2N6X6ohtA3vW1PrUVpOJrovd+uzfo3Srvw75PO0KkZfKHGesvLgaJ6ip8i+C QA9LyAKfcDyTDAplit+o6CbfX1Hw+Hh4IEQVxL6naXh3q/ryRUkOY4mEMHv/Dt8JW5EemFC7Wbz4+ OvmBCRzw/S2a2RV97OrcyGBirbqhhi+q0nSPGkI29O8q6rjnVgzrZUcIhEpLZWiBj/brjJSqJ/FqY TdyBLyRfr/2pD4DjSIVMga9NVya/4vIEA==;
Received: from www-data by mab.w3.org with local (Exim 4.96) (envelope-from <sysbot+mod@w3.org>) id 1wScki-00EYni-34 for ietf-http-wg@w3.org; Thu, 28 May 2026 15:34:32 +0000
Resent-From: List moderator <sysbot+mod@w3.org>
Resent-Date: Thu, 28 May 2026 15:34:32 +0000
Received: from ip-10-0-0-224.ec2.internal ([10.0.0.224] helo=puck.w3.org) by mab.w3.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from <murch@fastmail.com>) id 1wSbKY-00EKhK-2C for ietf-http-wg@listhub.w3.internal; Thu, 28 May 2026 14:03:26 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=w3.org; s=s1; h=To:Subject:From:MIME-Version:Date:Message-ID:Content-Type:Cc:Reply-To :In-Reply-To:References; bh=cZY1jE+AM+vdNbBOBLIVr/M8qeaaCsZeznOET/AvlcM=; t=1779977006; x=1780841006; b=UbE5MqN98hpFVOz6UBCaDAREspBAZAWfN2YpWUNcY0+YBUi ttnJ71skF14Te5B1IBbwWsSzdImDjtTRCxZc57PSPeiBL1vWUSKS+mjU98vNp7iALCLzLjUC+TVdn p7RXp9hL6delS2XVr7+F0f6suo022xsV1eQhV7i+1FoJYxB2jzUFJzyg58gVz2sD0Ibqu4t3+NTUU FXadSFKBTnRA+txfyuQXIslWwYTTATISgCkfbfOgXuZZZs67gEx/Tq9+MANHV2ntOMBU90eR/2Mzz 5XehuqKoE7oR6mJ3plz2gOA9te1+SQrixT2QkbUeLEsDhx/fwfNmN/LuKN7+W+Qw==;
Received-SPF: pass (puck.w3.org: domain of fastmail.com designates 202.12.124.153 as permitted sender) client-ip=202.12.124.153; envelope-from=murch@fastmail.com; helo=fhigh-b2-smtp.messagingengine.com;
Received: from fhigh-b2-smtp.messagingengine.com ([202.12.124.153]) by puck.w3.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from <murch@fastmail.com>) id 1wSbKX-003ZMW-39 for ietf-http-wg@w3.org; Thu, 28 May 2026 14:03:26 +0000
Received: from phl-compute-01.internal (phl-compute-01.internal [10.202.2.41]) by mailfhigh.stl.internal (Postfix) with ESMTP id 9D5237A00D5 for <ietf-http-wg@w3.org>; Thu, 28 May 2026 10:03:22 -0400 (EDT)
Received: from phl-frontend-03 ([10.202.2.162]) by phl-compute-01.internal (MEProxy); Thu, 28 May 2026 10:03:22 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fastmail.com; h= cc:content-type:content-type:date:date:from:from:in-reply-to :message-id:mime-version:reply-to:subject:subject:to:to; s=fm3; t=1779977002; x=1780063402; bh=cZY1jE+AM+vdNbBOBLIVr/M8qeaaCsZe znOET/AvlcM=; b=AmfvgM/c1BxV1ilK4ExcbVvF6+460waRy6e1NeVyxX81+YOB w9fSRX8iYSpFZ+EcuOfHjTesEkGoLKyGJeJCNPtaXOQ/Znjjk1O/QcffzGUkWDv8 VLK2/9mM5l2Nm42psXMoAdnKIWZ0XhPQN0KMbDZwwQPKsjHitniMBEb5l8fsJJac 5VVGY8ADd7pcR3w+BzH76crLkHgpEcRFPFEuWrpcXypBX+sLMA1Q+eluVEdYOQTn 19N1Z6RnCX5sWpfD/gcNmQ0nsGA9n+v65neHTbFPmqdYUX93g1ESXiOW3+d/ylWA iLwmc/DXt5AbE/Ku7dWmuA/tGQV6AHEPOIC5uQ==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:content-type:date:date :feedback-id:feedback-id:from:from:in-reply-to:message-id :mime-version:reply-to:subject:subject:to:to:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm3; t=1779977002; x= 1780063402; bh=cZY1jE+AM+vdNbBOBLIVr/M8qeaaCsZeznOET/AvlcM=; b=g emJiS8qES3bDOTFc9ep+1mhRSSZuDBjid9d1odzM7imCYjjqO2AI40/tyck5W0tc dGxiM5xZ16SVd+f4hm2D+2HVc44z4HT3a6bCSPPyQ7QZkW3GZZlF3FRKkkTSod40 Kw7DwVSgnXW08Cpv1DOEFgfUtgu6AIkuteSIPdxXKtDADTVBRWAs04mkasGgJWZV vsklnB0ylhvyfiloDiiaxaBd0vB/K3DtBbKdt2ZIJ/VBqBFfa/UW0wL4eEQjmGwQ pMVqiUVnqiUJXzJQNvfEqNypyLQIcmaT8Byar0VEXvQxYvkyjgucx9gWVTzJfUPc JjFG19lsqhBciXnP9A95A==
X-ME-Sender: <xms:KksYag5pr4EE79fc_a8N9mQgDUQspG5yJE9rn49562bo_rPYxDm8Ng> <xme:KksYanzglz_x8-K-1r2zsZtQVsNQ_quhKsuYqRigrWZ03SWP0bQy5xLcxi4mGDUZe jsIu9K5Meh9eO772iKSP-eP-o47Y95kBku3swr1YS3JMd4>
X-ME-Received: <xmr:KksYaqjJWgr-8SH55jIt0r8Aw7QDYkEaeND5UGLICWfjuClPhh1HTrLLy1I535wohhw>
X-ME-Proxy-Cause: dmFkZTEBA/lAvll+TX7DhARL7KDeETdi+zZbINn/MaQhBVkf6l3XTMkrRpiCVLZ7a3zBfX /+RAYpQsnb2YnAlU5CwMshzL+1alsejm2ubZcH9OF4OWIZe+9H5YbFrt9vZvfZhfJZq3Kz hO2iz0LBcoMAIu2GGkcVAB6yu/wFw1gyx9qQDv5iDwDUOI/1YW409KYJmJmitQo5iDdo/Q zKcAOP/ubT4UZGuZcLrh/h1loMO2TmDf0mXzrIT+Z3d4G/o3psgCAAND31aNkNRhLBuJL1 7AMsuWF0BbLCBGoQcBMj/Cm1pjlDVCseNa3Nt7xYlXYIExI3GPiPNQKcX7Xu5LhZMAlqkA Jqy2oX3XqraUW2E63LSCXe63ILPQKiVS7HRDOavNCnvyBoJQ6/e/zLS07mxYZ1PFQDvCJ3 A/y0vi4t97UvDEtX97qpC6CaUzdAC9EgDq5HnrKm/SAOlHvMNcp5yR51IUtowJ14Q8LEaG U6sNGmKRvGSNgBdDhoBuPe/rQpTQjcaBW+Vs1QfILmUNdZ4D4CQoU1M26QsIJhFHfZgBLU nGyfChA7W3gG0vIcOGpzeEzR2kgYZIgb8hgIohMFCTDdKmAlyJs1MZjQ7CZEREZsnSTn4V p5293o67YtoCqz68jntg9gBZPuXPf0+I1BjTLNVHkp41VvWzCRXTIO5cVdsw
X-ME-Proxy: <xmx:KksYah_hVDeRt2zycAfNFTi4ccU3TOVbu0eWnMFSPvHC0Zlr2NuCwA> <xmx:KksYansfHLht9CckxSHA5jBCWQ5JVVRfBCnZ7OsWcp_MKBKemHp8yQ> <xmx:KksYaoZqG8AnhpaBx74NNSkSz7e6loEBV_NCV5szQ7FGnkjZ7nW4dg> <xmx:KksYanq0DXYVdSwkHRd-GkgfqLvz2sffZwrtJA8ukoMzz5tNJ7BSpw> <xmx:KksYajrW4XSTEng_G0AxkhySX_AK8ZT2yzco1IMYVDZC8-NT1f_EbJ86>
Feedback-ID: ibf914243:Fastmail
Received: by mail.messagingengine.com (Postfix) with ESMTPA for <ietf-http-wg@w3.org>; Thu, 28 May 2026 10:03:22 -0400 (EDT)
Content-Type: multipart/alternative; boundary="------------rwoGs7i0zqexy07nbo9FOWZm"
Message-ID: <651dfce9-1f73-4536-8c10-15c5447aeab4@fastmail.com>
Date: Thu, 28 May 2026 10:03:20 -0400
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
From: Ken Murchison <murch@fastmail.com>
To: "ietf-http-wg@w3.org" <ietf-http-wg@w3.org>
Content-Language: en-US
Organization: Fastmail US LLC
X-W3C-Hub-DKIM-Status: validation passed: (address=murch@fastmail.com domain=fastmail.com), signature is good
X-W3C-Hub-DKIM-Status: validation passed: (address=murch@fastmail.com domain=messagingengine.com), signature is good
X-W3C-Hub-Spam-Status: No, score=-4.8
X-W3C-Hub-Spam-Report: BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, DMARC_PASS=-0.001, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, W3C_AA=-1, W3C_WL=-1
X-W3C-Scan-Sig: puck.w3.org 1wSbKX-003ZMW-39 068a3aec94174b40939af17803249025
X-caa-id: 3ade1d5568
X-Original-To: ietf-http-wg@w3.org
Subject: If header evaluation on MOVE request with both source and destination resources locked
Archived-At: <https://www.w3.org/mid/651dfce9-1f73-4536-8c10-15c5447aeab4@fastmail.com>
X-Mailing-List: <ietf-http-wg@w3.org> archive/latest/53867
X-Loop: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list
List-Id: <ietf-http-wg.w3.org>
List-Help: <https://www.w3.org/email/>
List-Post: <mailto:ietf-http-wg@w3.org>
List-Unsubscribe: <mailto:ietf-http-wg-request@w3.org?subject=unsubscribe>

All,

I am reviewing the If header field processing in the Cyrus *DAV server 
component.

I'm confused by the text in RFC 4918 with respect to a MOVE request 
where both the source and destination resources are locked.

The last sentence of Section 7.5 
<https://datatracker.ietf.org/doc/html/rfc4918#section-7.5> states:

For example, if a resource is to be moved
    and both the source and destination are locked, then two lock tokens
    must be submitted in the If header, one for the source and the other
    for the destination.

This leads me to believe that the MOVE request would have to contain two 
Tagged-List components and look something like:

MOVE /file1.txt HTTP/1.1
Destination: /file2.txt
Overwrite: T
If: </file1.txt> (file1-lock-token)
     </file2.txt> (file2-lock-token)

Logic would tell me that BOTH of the submitted lock tokens would have to 
match their respective resources in order to successfully process the MOVE.

However, the last paragraph in Section 10.4.3 
<https://datatracker.ietf.org/doc/html/rfc4918#section-10.4.3> states:

Finally, the whole If header evaluates to true if and only if at
    least one of the No-tag-list or Tagged-list productions evaluates to
    true.

I read this as saying that ONLY ONE of the submitted lock tokens need to 
match, NOT both.  Am I reading the text incorrectly or is the text 
itself incorrect?

-- 
Kenneth Murchison
Staff Software Developer
Fastmail US LLC
IETF MailMaint Co-Chair