Re: SETTINGS_MIXED_SCHEME_PERMITTED | Re: I-D Action: draft-ietf-httpbis-http2-encryption-07.txt

[Martin Thomson <[e-mail]>]

On 6 October 2016 at 00:36, Kari Hurtta <[e-mail]> wrote:
>> >> "tls-ports"  should perhaps now be "mixed-scheme-listeners"
>> >> giving [ "alternative-server:port" ].
>
> because should we really say that particular alternative server / port
> combination for given origin supports http: -scheme over TLS.

I interpreted that as:

  { "http://example.com": {
      "mixed-scheme-listeners": [ "example.net:767", "example.com:3324" ]
    },
    "http://other.example.com" { ... }
  }

This is saying that "http://example.com" is served (in addition to the
cleartext version) on those alternatives.

Whereas I was suggesting just taking the keys from the top-level object:

  [ "https://example.com", "http://other.example.com" ]

But I realize that this information is better obtained more simply
because you need to make a request for a .wk resource on every origin
you are interested in:

  GET http://example.com/.well-known/http-opportunistic HTTP/1.1
  Host: example.com

  200 OK
  Content-Length: 0
  Cache-Control: max-age=123

> Particular alternative server / port may be reverse proxy
> where behind of it there is several origins on different servers.
>
> But also for particular origin there may be several
> alternative servers which are not equal.

Not sure that I follow: are you suggesting that the .wk resource would
advertise the other origins, or that we need some sort of additional
protection?