IETF Logo Mail Archive

Re: x402

Martin Thomson <mt@lowentropy.net> Mon, 31 August 2026 05:31 UTC

Received: by mail2.ietf.org (Postfix) id A0B3113206237; Sun, 30 Aug 2026 22:31:32 -0700 (PDT)
Delivered-To: ietfarch-httpbisa-archive-bis2juki@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 9224E13206232 for <ietfarch-httpbisa-archive-bis2Juki@mail2.ietf.org>; Sun, 30 Aug 2026 22:31:32 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1788154292; bh=60Hv5Z/WRW6xEXxFRuOcGVOOZTuhYQ+Z3j7Ek15zgjE=; h=Resent-Date:Date:From:To:Cc:In-Reply-To:References:Subject: Resent-From:Resent-Sender:List-Id:List-Help:List-Post: List-Unsubscribe; b=ordq/SxOlyIMZJHaugQAsRVlLCIPQ56kxpKRJbduRE2GFAViPek7EvQymMfsNPgTN wLxsfofDwEfV107SqoTvt9lgH1IHCOKyxXJU9e/nqFnHAQIqqntj+TASMXyps0ERLl lKWeuE+LYlL5SjwgzeZuzlB+ln2vHfnaE7uhDYxc=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -5.4
X-Spam-Level:
X-Spam-Status: No, score=-5.4 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, MAILING_LIST_MULTI=-1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=w3.org header.b="Kfp6DA+/"; dkim=pass (2048-bit key) header.d=w3.org header.b="a4mQlgJY"; dkim=pass (2048-bit key) header.d=lowentropy.net header.b="idZgu2GY"; dkim=pass (2048-bit key) header.d=messagingengine.com header.b="cD7N4JVs"
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XpXaOfGQJBf4 for <ietfarch-httpbisa-archive-bis2Juki@mail2.ietf.org>; Sun, 30 Aug 2026 22:31:31 -0700 (PDT)
Received: from mab.w3.org (mab.w3.org [IPv6:2600:1f18:7d7a:2700:d091:4b25:8566:8113]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id ECCB01320622D for <httpbisa-archive-bis2Juki@ietf.org>; Sun, 30 Aug 2026 22:31:31 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=w3.org; s=s1; h=Subject:Content-Type:References:In-Reply-To:Message-Id:Cc:To:From: Date:MIME-Version:Reply-To; bh=H3BprTcNgbWfU0/9kWPInHsMcTo9rNz445p6FqnrEfI=; b=Kfp6DA+/+obGeNwBvicJEsQnMTC/WXrQlxVUoqqLHtF8Sc56kUA3MIPzyoThx/07Qn0McOE3I7J xjsAIyJnHvr087904ZKOOJ+DxCwg7Iq0c8IDu3rNSyEY4SuQ/hB4YvONdfMkXX4CPIY0YTLAxaDKT 2ppdfRDs+JUA3llQ02qmBubYCrkCxzgVmZ7cAeSjOlFZNDIvGEPLIreijPJ4QITJPQ4rk6bIUiLl5 8v5ufgASlCc0eFN+tvQNkClFApZ5IiQA3d1W9lh1BhrTc2CuRgBQS5h3idMbPhiw4TiFuqGDwvCkP YQ1tt3ipltob3Hqi8h3XJKkwQxW7PNefIGbw==;
Received: from lists by mab.w3.org with local (Exim 4.98.2) (envelope-from <ietf-http-wg-request@listhub.w3.org>) id 1x0ubI-0000000Cn4I-0Io0 for ietf-http-wg-dist@listhub.w3.org; Mon, 31 Aug 2026 05:30:32 +0000
Resent-Date: Mon, 31 Aug 2026 05:30:32 +0000
Resent-Message-Id: <E1x0ubI-0000000Cn4I-0Io0@mab.w3.org>
Received: from ip-10-0-0-144.ec2.internal ([10.0.0.144] helo=pan.w3.org) by mab.w3.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from <mt@lowentropy.net>) id 1x0ubF-0000000Cn3O-39GL for ietf-http-wg@listhub.w3.internal; Mon, 31 Aug 2026 05:30:29 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=w3.org; s=s1; h=Content-Type:Subject:References:In-Reply-To:Message-Id:Cc:To:From: Date:MIME-Version:Reply-To; bh=H3BprTcNgbWfU0/9kWPInHsMcTo9rNz445p6FqnrEfI=; t=1788154229; x=1789018229; b=a4mQlgJYJqzV4cuUHLqqW9RtQTjlHUKkUt6R/NeIeQgVVJQ 2iaNhHXdrmA9Luy3dTEiQqygQgRbLmDXRYAaXTz3Jz21Rx1eUR+05KKimYvkGB59c29B3cgqGHcfL I+iiwZVkmnr0hUhnnQL2rXBkqsVasRRDH9ygvnubGMxK1UMoYkoKD9Zq14mvizVxTf+IFrd+r11y7 Ybq5SlxQFL9M2YdCJNfCKYb71k/HPKCgywiWhFwf82TPyqh9u1hp87H9RYnKZK3TEB5AWbh+37/pm wOiA4Z8MdJoAMp8M1UlVDzZK8/SkbMpaijRrh7SUG92AEPs/ETcWvFa8/1NYQReg==;
Received-SPF: pass (pan.w3.org: domain of lowentropy.net designates 202.12.124.153 as permitted sender) client-ip=202.12.124.153; envelope-from=mt@lowentropy.net; helo=fhigh-b2-smtp.messagingengine.com;
Received: from fhigh-b2-smtp.messagingengine.com ([202.12.124.153]) by pan.w3.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from <mt@lowentropy.net>) id 1x0ubF-00000005Xao-2MGu for ietf-http-wg@w3.org; Mon, 31 Aug 2026 05:30:29 +0000
Received: from phl-compute-04.internal (phl-compute-04.internal [10.202.2.44]) by mailfhigh.stl.internal (Postfix) with ESMTP id 92D4F7A0134; Mon, 31 Aug 2026 01:30:25 -0400 (EDT)
Received: from phl-imap-15 ([10.202.2.104]) by phl-compute-04.internal (MEProxy); Mon, 31 Aug 2026 01:30:25 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=cc:cc:content-transfer-encoding:content-type:content-type :date:date:from:from:in-reply-to:in-reply-to:message-id :mime-version:references:reply-to:subject:subject:to:to; s=fm1; t=1788154225; x=1788240625; bh=H3BprTcNgbWfU0/9kWPInHsMcTo9rNz4 45p6FqnrEfI=; b=idZgu2GYJr65gZVYFEhLrUnpp5iLYpBoDaFK37B4pMXQ8QLy WwFO08LiVCnnaEHE9B/BQecP52UBsS3EEAr3p8ajKdxZ6wQOakqeOa+QyHj+aFn8 Cn6+KQC+fyOjRiRFWV0dPBJ+kUY4E6dpj+c0fHX4hU+Bj543MzX3OGjrfOxx1CE5 5LLHP0y8X/BMW0SUi8uxUpzdTRTIigxPM9wF5VaZfcanjKkcIY67gidPC+crJJ1k FRya0b0S35eOR9xmJXxlyJI/ChhJ9L4IoQeAbX5uKjGwA3DSAjZXe1y3a+KtklE6 lxkIPDc8rbYboHX2eQq/T4/z+J7zVXVAnJQB4g==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:feedback-id:feedback-id :from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm3; t=1788154225; x= 1788240625; bh=H3BprTcNgbWfU0/9kWPInHsMcTo9rNz445p6FqnrEfI=; b=c D7N4JVszz0v5nZWzi723bZGaPSv4aFP9MPgvHYjdEPBpPr/kUT0uyGWdsY4oMOfc WKkC6Z4GS4+MRt8ZI4a6vH3XHP5VgaWASESeh8jGZusA7O4x67rTodayPWdknX5k MG/avr1S++pOcBXF9ivtXyXzzl0bLGkY656KNtdUFXs90HWE1su4N1JZ1dfpdVwO pmCYYIzg/rSwVuKZvFL0HXQ+kf+jtse06ixQmu0hrJgU+90+pdopT5WnYThTW0Zo s+lS2vvSdIl2p5R0ZCchrTC8VxxMJWXYBaMXKlcxgBz6/aBpXfTavnBtx8Y2Q+s0 3iBrvmOPA42oMrHnh8aBQ==
X-ME-Sender: <xms:cBGVajJFoZddaNDuVHbuvlQOxcZK4xZvrVTf572CamgyTnwyDl3rcw> <xme:cBGVah82fHVorND_O8imWR1trhA66PZerZ9XbCkegGJn0zcrDHuI-ZQHgGibz5O1m 3bTWqyA6SOQGKsuxBznLTsumwqrnoCXN3qbIfCRbyMFy7x21__GUyCC>
X-ME-Proxy-Cause: dmFkZTGz/bsAPQf0rfbrIDCNfFBJoqmxA8c3T6AGnC5yFTTJegpKRVANvo2O6+hmD1K74G UmrfNnlGRxLhfXUUi0bsHxum80fNJ5g9WgMph/bPjPNSJDHebcdpFfyUgjen7mKQks/MG+ VVfNmOyno8Pydp4TtfKf0ElGuYAfsG8mYDUSx2gAabdGhyIzr+dj4vv2Esu4AkP3ZRh5BI v44tD4iPYzwQVUWvloO7EUpWsPx4t4/WdgSAWwOTIvQ747poHcje+fkEwm68TWJ6+7o8nh 4IKvva4O8cn+zo4SEBEI/Yqq8S4lUHqF3gh1OuLHviKc33lRBmVIQYJ7GfLyE2O7EhhlTd YtcJfLIK3On5ptNGT5X0wZJQwpygQn/hQ+/ttY/MSEINf9NPPG0Nt2e3Bg9bq43MRy3QBU h0/uiD/5zBeEvqtI48wIqj45QB3Mt3g3PMTZOr3hGtxbYKJudS3Yj3d8ZnE5TXhVaC/TKV Svqo3UGOoHSwY15yjhzZbyjjEuGzB2WUhyC4WAGgkjjIQBUHf+5+TYCFZvtAJQsSJ+obUd bsOQNdRAswhQC3w5KXgpJ8QoXARXCqB2Gqi/K0tKEzU9+2s8HsVG2DvSbOYSpJSnGYY7Ie Fk9xPbVOjFF4DBNAg73isWdCCIUp2fCApsgz/qL37Xx7bolAW+U3AtXRsEqg
X-ME-Proxy: <xmx:cBGVarx8p_8IVXzTbQtftUjLLbXQ7tAOd1_a6oiVs_wJxn6qr2q1Fg> <xmx:cBGVahES0TKhsWKnbvoHf0xApw8JVpO4s3oM1j_SbLtJz93I3O2vhg> <xmx:cBGVavwsLYxX3B2RCEESbaKEjVLQMVijLWuosveVvD1MA0z2ISlBuA> <xmx:cBGVaivdjJR4ozRHuPNyCSZMutVreKCshTi8V0oeDjzohGiv7lCtVw> <xmx:cRGVaisz6L0Y3fm0I3p2Iu4zrh4514PalPoXecHUy0WHo2IG1PU7d3o1>
Feedback-ID: ic129442d:Fastmail
Received: by mailuser.phl.internal (Postfix, from userid 501) id 788FA7811F0; Mon, 31 Aug 2026 01:30:24 -0400 (EDT)
X-Mailer: MessagingEngine.com Webmail Interface
MIME-Version: 1.0
X-ThreadId: ABTIPl34RdCo
Date: Mon, 31 Aug 2026 07:30:03 +0200
From: Martin Thomson <mt@lowentropy.net>
To: Poul-Henning Kamp <phk@phk.freebsd.dk>, Tim Bray <tbray@textuality.com>
Cc: Mark Nottingham <mnot@mnot.net>, ietf-http-wg@w3.org
Message-Id: <b14a9b2d-44df-48d0-a67f-5681e47f8ae4@app.fastmail.com>
In-Reply-To: <6a948d8f.b860f.2e9afe73@critter.freebsd.dk>
References: <ff1935b8-b2c0-4322-8d6d-3797650eaa49@app.fastmail.com> <480DD599-C505-4B75-BB02-B5CC7C4D7E72@mnot.net> <CAHBU6iveug5k686NM4RoDbi47jbNUF05nUjG3w0yKyAz6BTT0g@mail.gmail.com> <6a948d8f.b860f.2e9afe73@critter.freebsd.dk>
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
X-W3C-Hub-DKIM-Status: validation passed: (address=mt@lowentropy.net domain=lowentropy.net), signature is good
X-W3C-Hub-DKIM-Status: validation passed: (address=mt@lowentropy.net domain=messagingengine.com), signature is good
X-W3C-Hub-Spam-Status: No, score=-9.8
X-W3C-Hub-Spam-Report: BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, DMARC_PASS=-0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, W3C_AA=-1, W3C_DB=-1, W3C_IRA=-1, W3C_IRR=-3, W3C_WL=-1
X-W3C-Scan-Sig: pan.w3.org 1x0ubF-00000005Xao-2MGu fc4e6742158e2aa1c267be887c948b94
X-Original-To: ietf-http-wg@w3.org
Subject: Re: x402
Archived-At: <https://www.w3.org/mid/b14a9b2d-44df-48d0-a67f-5681e47f8ae4@app.fastmail.com>
Resent-From: ietf-http-wg@w3.org
X-Mailing-List: <ietf-http-wg@w3.org> archive/latest/54169
X-Loop: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list
List-Id: <ietf-http-wg.w3.org>
List-Help: <https://www.w3.org/email/>
List-Post: <mailto:ietf-http-wg@w3.org>
List-Unsubscribe: <mailto:ietf-http-wg-request@w3.org?subject=unsubscribe>

On Sun, Aug 30, 2026, at 22:07, Poul-Henning Kamp wrote:
> That smell is "Pay-Per-View on the Internet", 

That's *a* smell here, but this doesn't need to be that.  Services with subscription-based membership might be able to use this to ask clients to show that their subscription is up to date, without the implication that authentication is involved.  For that, see Privacy Pass and its use in the context of VPNs as an example where proof of payment does not lead to authentication.

However, it's hard to disentangle 401 from this.  A decision to deny access on the basis of (a lack of) payment is still fundamentally an authorization decision.

v2.46.0 | Report a Bug | By Email | System Status