IETF Logo Mail Archive

RE: Op-sec simplification

Mike Bishop <Michael.Bishop@microsoft.com> Mon, 31 October 2016 23:29 UTC

Return-Path: <ietf-http-wg-request+bounce-httpbisa-archive-bis2juki=lists.ie@listhub.w3.org>
X-Original-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Delivered-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9CBC9127078 for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Mon, 31 Oct 2016 16:29:33 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -8.498
X-Spam-Level:
X-Spam-Status: No, score=-8.498 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-1.497, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gmauSdS4O32m for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Mon, 31 Oct 2016 16:29:31 -0700 (PDT)
Received: from frink.w3.org (frink.w3.org [128.30.52.56]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E1595129415 for <httpbisa-archive-bis2Juki@lists.ietf.org>; Mon, 31 Oct 2016 16:29:30 -0700 (PDT)
Received: from lists by frink.w3.org with local (Exim 4.80) (envelope-from <ietf-http-wg-request@listhub.w3.org>) id 1c1LxH-0002e3-Vb for ietf-http-wg-dist@listhub.w3.org; Mon, 31 Oct 2016 23:25:27 +0000
Resent-Date: Mon, 31 Oct 2016 23:25:27 +0000
Resent-Message-Id: <E1c1LxH-0002e3-Vb@frink.w3.org>
Received: from titan.w3.org ([128.30.52.76]) by frink.w3.org with esmtps (TLS1.2:RSA_AES_128_CBC_SHA1:128) (Exim 4.80) (envelope-from <Michael.Bishop@microsoft.com>) id 1c1LxB-0002cQ-R5 for ietf-http-wg@listhub.w3.org; Mon, 31 Oct 2016 23:25:21 +0000
Received: from mail-by2nam03on0100.outbound.protection.outlook.com ([104.47.42.100] helo=NAM03-BY2-obe.outbound.protection.outlook.com) by titan.w3.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.84_2) (envelope-from <Michael.Bishop@microsoft.com>) id 1c1Lx5-0004O6-Ha for ietf-http-wg@w3.org; Mon, 31 Oct 2016 23:25:16 +0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=n28D8rA28DPDdbV9VvIUnFwW9PePmkOZ84W1Bdsg73I=; b=I3dLWs5Ok5gFw+Fm2VAYesgrhA5rPvGzCyM+9oBAm2gc+CbbncCqvHmSee/4x6YSbvOZwYH7+ucmuMOJvXVhym2+y3ZrmxHj7refKGDyg3UB62wciy0snO+MQRm7711UJ3DzAHcH748ETgAc3TuBxUVL2jtLnessZvWgogtF/dk=
Received: from CY4PR03MB2710.namprd03.prod.outlook.com (10.173.43.141) by CY4PR03MB2709.namprd03.prod.outlook.com (10.173.43.140) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.693.12; Mon, 31 Oct 2016 23:24:46 +0000
Received: from CY4PR03MB2710.namprd03.prod.outlook.com ([10.173.43.141]) by CY4PR03MB2710.namprd03.prod.outlook.com ([10.173.43.141]) with mapi id 15.01.0693.009; Mon, 31 Oct 2016 23:24:46 +0000
From: Mike Bishop <Michael.Bishop@microsoft.com>
To: Mark Nottingham <mnot@mnot.net>, Martin Thomson <martin.thomson@gmail.com>
CC: Kari Hurtta <hurtta-ietf@elmme-mailer.org>, HTTP working group mailing list <ietf-http-wg@w3.org>
Thread-Topic: Op-sec simplification
Thread-Index: AQHSMzgxU/1c8rIat0qK8dwR+i9dY6DDKYYAgAAJTYCAAACEAIAAAd6g
Date: Mon, 31 Oct 2016 23:24:46 +0000
Message-ID: <CY4PR03MB27104BDCA1FDCC28FFBBC18887AE0@CY4PR03MB2710.namprd03.prod.outlook.com>
References: <20161031053239.E9C6D12F5D@welho-filter3.welho.com> <842E817E-77E4-45E0-B5E3-D45F8D7AFA15@mnot.net> <CABkgnnVm2roXz5BiQeh5m2a_zcsfC3rFZ2pnoQ_m9k6b3K=58w@mail.gmail.com> <4CE68DCC-BE25-42DE-9247-4195103797EF@mnot.net>
In-Reply-To: <4CE68DCC-BE25-42DE-9247-4195103797EF@mnot.net>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Bishop@microsoft.com;
x-originating-ip: [2001:4898:80e8:8::390]
x-ms-office365-filtering-correlation-id: e21b402a-3f45-4118-3705-08d401e51a3c
x-microsoft-exchange-diagnostics: 1; CY4PR03MB2709; 7:UNmRFnsEQ4WEBLt0hmAhPVX3FPm6qLuH0xbuE5mPUHewzxFI8QlXjHz63mKHeHa5K9kqkXdpT1hClquCjDO0S7ZdUTfuyxqe4z0D3BqUlRu54wkl4UoFZQFvBYrJfi99K4qJ+M0wRn9b38uLuRLAubIeqJ2HCvtAdx1yXDkCXiU0DNnJE7Jec04JrTJ0htlejDVdnNIjCownjeEYxQsUKkrQ3/hpItasxcjfsv/odcWEvxs/eBRsKlvdoo1QITI8pNW1/zLjzkD3/S9hygB5JLdbzApswOnwu2zAljb1eEr5KvA6JkUa0uHyw0FPACZHlrUA6sIVlb4aMQZSxuAl5MzzPQAuMmitb34dM/fU300mBx/njc5B8l0+t8D6Krj1
x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:CY4PR03MB2709;
x-microsoft-antispam-prvs: <CY4PR03MB27094862D8A93A4A126332E087AE0@CY4PR03MB2709.namprd03.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:(158342451672863)(100405760836317);
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6045074)(6040176)(6060202)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026)(61426038)(61427038)(6046074)(6072074); SRVR:CY4PR03MB2709; BCL:0; PCL:0; RULEID:; SRVR:CY4PR03MB2709;
x-forefront-prvs: 01128BA907
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(24454002)(13464003)(189002)(199003)(377454003)(81166006)(2906002)(19580395003)(76576001)(93886004)(10090500001)(5001770100001)(86362001)(86612001)(19580405001)(97736004)(81156014)(5005710100001)(102836003)(4326007)(7696004)(33656002)(6116002)(586003)(87936001)(5660300001)(2950100002)(3280700002)(77096005)(106356001)(74316002)(92566002)(305945005)(3660700001)(7736002)(189998001)(76176999)(50986999)(54356999)(7846002)(8676002)(10290500002)(5002640100001)(101416001)(15975445007)(2900100001)(8990500004)(8936002)(9686002)(122556002)(68736007)(3480700004)(106116001)(105586002)(11100500001)(99286002)(10400500002); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR03MB2709; H:CY4PR03MB2710.namprd03.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en;
received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts)
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: microsoft.com
X-MS-Exchange-CrossTenant-originalarrivaltime: 31 Oct 2016 23:24:46.3553 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR03MB2709
Received-SPF: pass client-ip=104.47.42.100; envelope-from=Michael.Bishop@microsoft.com; helo=NAM03-BY2-obe.outbound.protection.outlook.com
X-W3C-Hub-Spam-Status: No, score=-3.9
X-W3C-Hub-Spam-Report: AWL=-2.428, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, W3C_NW=0.5
X-W3C-Scan-Sig: titan.w3.org 1c1Lx5-0004O6-Ha b2c641fe3c0d1f578174454274a0abe6
X-Original-To: ietf-http-wg@w3.org
Subject: RE: Op-sec simplification
Archived-At: <http://www.w3.org/mid/CY4PR03MB27104BDCA1FDCC28FFBBC18887AE0@CY4PR03MB2710.namprd03.prod.outlook.com>
Resent-From: ietf-http-wg@w3.org
X-Mailing-List: <ietf-http-wg@w3.org> archive/latest/32767
X-Loop: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list
List-Id: <ietf-http-wg.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Post: <mailto:ietf-http-wg@w3.org>
List-Unsubscribe: <mailto:ietf-http-wg-request@w3.org?subject=unsubscribe>

There's an explicit requirement in RFC 7230 for servers to accept it:
>   To allow for transition to the absolute-form for all requests in some
>   future version of HTTP, a server MUST accept the absolute-form in
>   requests, even though HTTP/1.1 clients will only send them in
>   requests to proxies.

-----Original Message-----
From: Mark Nottingham [mailto:mnot@mnot.net] 
Sent: Monday, October 31, 2016 4:17 PM
To: Martin Thomson <martin.thomson@gmail.com>
Cc: Kari Hurtta <hurtta-ietf@elmme-mailer.org>; HTTP working group mailing list <ietf-http-wg@w3.org>
Subject: Re: Op-sec simplification


> On 1 Nov. 2016, at 10:15 am, Martin Thomson <martin.thomson@gmail.com> wrote:
> 
> On 1 November 2016 at 09:41, Mark Nottingham <mnot@mnot.net> wrote:
>> Hold on -- are we layering in a new requirement to use the absolute form of the URL?
> 
> I don't know how we carry the scheme any other way.  We might try to 
> weasel this as being not "directly" to the origin server.
> 
> Maybe I should point out that this is in contradiction to that section.

I suspect someone with a process bent will say that it needs to update 7230, and having an experimental doc update a standards track one might be... interesting. I suppose if we have consensus to do it, it might work.


> (FWIW, the servers I'm aware of all handle absolute URIs well enough.)

Is there an implicit requirement for them to check that it was absolute?

--
Mark Nottingham   https://www.mnot.net/

v2.23.0 | Report a Bug | By Email