Re: Adoption call for draft-schwartz-httpbis-optimistic-upgrade

[Martin Thomson <[e-mail]>]

Yes, we should adopt it.

Maybe the first thing we should do is add a clear description of what a client OR server can do to avoid the problems.  The server treating Upgrade as implying Connection: close might be a good start, counter to what Section 4 currently says.  We should not be recommending mitigations that only one affected party can deploy.

On Wed, Jan 24, 2024, at 04:41, Tommy Pauly wrote:
> Hello HTTP,
>
> This email starts a working group adoption call for "Security 
> Considerations for Optimistic Use of HTTP Upgrade”, 
> draft-schwartz-httpbis-optimistic-upgrade. Notably, this updates RFC 
> 9298 (connect-udp, which was produced by the MASQUE WG) on how to 
> handle HTTP Upgrade, including to disallow optimistic data sending for 
> HTTP/1.1.
>
> The document can be found here:
>
> https://datatracker.ietf.org/doc/draft-schwartz-httpbis-optimistic-upgrade/
> https://www.ietf.org/archive/id/draft-schwartz-httpbis-optimistic-upgrade-00.html
>
> This adoption call will last for 3 weeks, until *Tuesday, February 13*. 
> Please reply to this email with your reviews and comments, and whether 
> or not you think HTTPBIS should adopt this draft.
>
> Thanks,
> Tommy