Resent-Date: Thu, 11 Jul 2024 15:02:33 +0000
Resent-Message-Id: <E1sRvJZ-002maU-18@mab.w3.org>
Received-SPF: pass (puck.w3.org: domain of meta.com designates 67.231.145.42 as permitted sender) client-ip=67.231.145.42; envelope-from=prvs=2922d2fe4f=bemasc@meta.com; helo=mx0a-00082601.pphosted.com;
From: Ben Schwartz <bemasc@meta.com>
To: "ietf-http-wg@w3.org" <ietf-http-wg@w3.org>
Thread-Topic: Updates to "optimistic upgrade"
Thread-Index: AQHa0587slDtNxYXUE2pfOSflFLuBQ==
Date: Thu, 11 Jul 2024 15:02:21 +0000
Message-ID: 
 <SA1PR15MB4370490422595A884B57EED3B3A52@SA1PR15MB4370.namprd15.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
msip_labels: 
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: SA1PR15MB4370:EE_|SA0PR15MB4029:EE_
x-ms-office365-filtering-correlation-id: ec191452-5dfb-4e70-f531-08dca1ba776d
x-fb-source: Internal
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|376014|1800799024|366016|38070700018;
x-microsoft-antispam-message-info: 
 =?iso-8859-1?Q?dBMyLxkLnSdBYNuxcDQKegR7OyxHPPeOa+lp+3iYKURn83JvEXASEvP6iA?=
 =?iso-8859-1?Q?o4CqwnSLyuPze3Dwv8Hba+1dzbNL6b4IV+pDTo34HhhlZiBDgCg5LBf3bc?=
 =?iso-8859-1?Q?zoXErqQYzLZJuhOvHRabKlOgCkIecs1n9WtRad7hv1EFucKWABSrDa9hAB?=
 =?iso-8859-1?Q?6H8xukLNwUIbpaipniI/864LXDOoInaVRBRVMQaEObV8xzYrul8Nq1okjq?=
 =?iso-8859-1?Q?SB9AudVnLh17L4YgJcV/IOZgMdAf+4P5MxNcSrShhXJXnXEM29oQouq1jF?=
 =?iso-8859-1?Q?tSE/vqPTpch1PeKbqKITJLLFeLp/PJapam3zER4UhVNDfLk6pmtit4DC9k?=
 =?iso-8859-1?Q?xlpcgklAm6c07jMagV872z1MbZpaJhosZCy1X+S3aZq5Y39tE69rvxn/vZ?=
 =?iso-8859-1?Q?OrhfxBt7LsGMI+wIiLRX6za9LGAVUfCZPpzwVWbNrTJV4/WSS28DKmpRvU?=
 =?iso-8859-1?Q?DlOmwZ6TEqceSKzQsCOFMDV03mWda1ipc8P3FHD/Ua0NtSTiiDtf6tXiIU?=
 =?iso-8859-1?Q?fvEAUBKJYu0mbCtwsZEkCac50KTmGzvmMfcfsW+AvvtIWnITMZVpJ42ntl?=
 =?iso-8859-1?Q?vffgSnRHxoHtq6XsYvO7frHLe//vz33b7KkF+mtiUSSEKktD1IjUahE2wN?=
 =?iso-8859-1?Q?9Kr8y9/2gv/UDX1viBFywylu9aiJmfYwtpIQhva/VjLqzDVQXykp5aNGUE?=
 =?iso-8859-1?Q?w+FbquHgEaYhbK2gNLcaNlOY7jHKLbiQfWi8tyBFZbEDRrY18Bu/3CHzpC?=
 =?iso-8859-1?Q?edOQjBiURhhs8z2e7w+ZcWI7gV7YhA3/3R/LoWeEgC+042hRbL9/CGzcV1?=
 =?iso-8859-1?Q?TrdXWqoMdAsem/O+Y1b5fJCsZDVgr653cASTkdHO+dl2A9p5rKnlMxnBl5?=
 =?iso-8859-1?Q?45g3BzZKhw7bq764U4gWHS5uSxGhOiWAlmwxPCz/AD6iIxbwZG5W8a2VUV?=
 =?iso-8859-1?Q?Zq7RJVsJWZdqj1WpRfguMT33QckOHrkSFomx+IjOp/5QWaZpitFC8By0Vg?=
 =?iso-8859-1?Q?MBFCpmC5BjbhfoLrDnjicwF/8dLXNKwq3grFZmUMVqkNi+rH03bFd0q561?=
 =?iso-8859-1?Q?EtoO/Mon3hbKzTK53ZC8ioc/jgx6jzQiZWV8NYx30UDGxBj2yU9Nqg8LJY?=
 =?iso-8859-1?Q?QLXNrfgQgpHehAZN0uDDM78/oa9SpkyO7PSN25Azyogelpmim3nsBp3fIe?=
 =?iso-8859-1?Q?2FJYNrkO+23RGQqYV4iUj6kYjS4WbliKb69NnyqgROyPs4aSHhE48IgS4f?=
 =?iso-8859-1?Q?92711APxjhNm2WSMK7euWYjtro08ly0ctudfSg1dCjR0dNMfq5ZvKHJsPN?=
 =?iso-8859-1?Q?ImJk+vjjeZYEWr1z/S3pHJZ7ADs4R6iOSiKOZZSV/FnlgeRWLSvdNiumpz?=
 =?iso-8859-1?Q?LETTvhQenKPGB6pszhlk80v+ENdhdhxG49+WM66bLRZvkZ+hoNYmU=3D?=
x-forefront-antispam-report: 
 CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SA1PR15MB4370.namprd15.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(1800799024)(366016)(38070700018);DIR:OUT;SFP:1101;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: 
 =?iso-8859-1?Q?x6gMB3f87omjAfvqYa+aSKO/dwsrACjte59Nb5cnlg1K5Rial2UbcojqjZ?=
 =?iso-8859-1?Q?1e1l9oBNi589yJu71Uiuib9Wxwx31gl5t3e3P77YC8CJZ+v0/rUQZpx3i8?=
 =?iso-8859-1?Q?IscSdgVym/M9c8Oza9IfsYXu9WAEHfT4hgpMXtJ/O4XhLfoKkgOipG2ve5?=
 =?iso-8859-1?Q?ZUcax4ZPKfUoQ8YEA1R7IwlwwUgKanKLMJKL3A2924fmAHhuEzWekyg95B?=
 =?iso-8859-1?Q?n/KR74CiPQCgVZqqvTynM6zPDSGtLOlT77aRbzwTMfbYVVgEovJZxattjK?=
 =?iso-8859-1?Q?tR78+dwLKVgDvDGm4auTw9Of2nxBHH9i2a5BFeeVdPl9RFUn90SK2vAFhi?=
 =?iso-8859-1?Q?DAbM1hGhsC9OcOASGoA+UgziPNx0fx6dDb6j4whV7ZsWONdjolMTjOF0ac?=
 =?iso-8859-1?Q?1zFVTmk969zy6QoqohFQvfkOf1JgqLGO6b2/mYew3JuF2KaTep7Yk55vaK?=
 =?iso-8859-1?Q?uLK1EFqdfoYE6uoXOI68j0GIgf8Xt1E40va3swl/NsC5fjjS34wpypJ9Ye?=
 =?iso-8859-1?Q?FbRsvGfNsGYnsKJiZJRY3eJlcmOBfT/m+/SS0aOG7LaeFKLxLYLJadpbIl?=
 =?iso-8859-1?Q?8i7qZPm+q9GBhRqgD7pIFKjHu+1kUV1aSgCbpfoP4mZOm4iZL2TzMZCkdn?=
 =?iso-8859-1?Q?KPPsNorWmXvyJFD/kixkL7XhxD9SpqbwWOp7RihRQ4VJSS3Ao0Sb/2ieNm?=
 =?iso-8859-1?Q?gLuhaaCiZI9ihiOM9hUB25/XIcYjOLpyb7aScdJ8mmtn5arQMh5BeHgi0+?=
 =?iso-8859-1?Q?/3lan+oTS0+/G0deNIzz5Ant2pRhfqWBSOTR/9F1PuePygsAaH974EuD80?=
 =?iso-8859-1?Q?/qvR8onIhVO5ka+iKHXqMNWddxbnsf5YseKqqUnQZopC9uIIp38RvkhLKI?=
 =?iso-8859-1?Q?GV1DAgLoK56CW/9OZq0h1rAErTUfZzvdZmToruCz9wogrFuJqLvlakxqaI?=
 =?iso-8859-1?Q?BzrCkiLDDzfMcA071ZyWWqWTQDw8h9LkkuMZhPx6/+IMS+0+83U09/wJfb?=
 =?iso-8859-1?Q?hZzRyGF8PIJQRQhW0vHL6PX8m61k0LEN1j2/MmP6J6QOaz+6tDfp8EOs/Q?=
 =?iso-8859-1?Q?azj+TYpMpvPCiGWZBfR20qmQoNnxDLkCNTCo+78CdwgX4AjNanXtF+YE9T?=
 =?iso-8859-1?Q?dtoZfPyAUCMw1Z3S1svDNABYgvCsZOS5kbT3pLoXp3wm6WBQTUGkP1/d32?=
 =?iso-8859-1?Q?ULrcDkpOGJpzweZ92353CUQdhtKiC3HBCXsi+oEtAwfi84L7hOQ5TaAmeH?=
 =?iso-8859-1?Q?jeJpjvB2qAvmyshSx6TtAPtvAf6n05CacyiP5cHDSQWsx3JvPNAwOTmwMu?=
 =?iso-8859-1?Q?iZIEOyGNd1aXUdfBzK/uBU/Zy+L57SawvROA9GuE8OQbnDDNRILA2YmJS7?=
 =?iso-8859-1?Q?H/1/deVPvFTy766xEK1KeNrRnDXBbJ6GpUWGyqhaN46LNpkTxszICDwNhF?=
 =?iso-8859-1?Q?9vAf7aZF2vwDAO4ER6OUfJg41BSDErWD8J9wZpqPYA8jHL5Rby2EDfBqIr?=
 =?iso-8859-1?Q?fAfTs5T5LNMZc9IqqLmsgawdUUvRQspcXLE+EPZfphyAogHfncKIr+o01D?=
 =?iso-8859-1?Q?LIzEnzgEiy5WO2ovX7zAVj/yNTk9lR+QjCwkmkazb6rh26Jheo6PxTDwOI?=
 =?iso-8859-1?Q?3eIC5fkJ+8vYo=3D?=
Content-Type: multipart/alternative;
	boundary="_000_SA1PR15MB4370490422595A884B57EED3B3A52SA1PR15MB4370namp_"
MIME-Version: 1.0
X-OriginatorOrg: meta.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SA1PR15MB4370.namprd15.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: ec191452-5dfb-4e70-f531-08dca1ba776d
X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Jul 2024 15:02:21.8961
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: x/QbCBPwL4pvCFh4r6VRLv2UvDJ+JOGK6rm7k3rvY9q1xvC6IeHZqLg2r/Iu1unM
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR15MB4029
X-Proofpoint-GUID: G--0uvBTpDTtNWXuS5O9HAzVwHF5suFh
X-Proofpoint-ORIG-GUID: G--0uvBTpDTtNWXuS5O9HAzVwHF5suFh
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.293,Aquarius:18.0.1039,Hydra:6.0.680,FMLib:17.12.28.16
 definitions=2024-07-11_10,2024-07-11_01,2024-05-17_01
X-W3C-Hub-DKIM-Status: validation passed: (address=prvs=2922d2fe4f=bemasc@meta.com domain=meta.com), signature is good
X-W3C-Hub-Spam-Status: No, score=-4.1
X-W3C-Hub-Spam-Report: ARC_SIGNED=0.001, ARC_VALID=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, DMARC_PASS=-0.001, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, W3C_AA=-1, W3C_WL=-1
X-W3C-Scan-Sig: puck.w3.org 1sRvJV-00HA0Y-0d 491d4ec35230b7d43ded08a8b828554c
X-Original-To: ietf-http-wg@w3.org
Subject: Updates to "optimistic upgrade"
Archived-At: <https://www.w3.org/mid/SA1PR15MB4370490422595A884B57EED3B3A52@SA1PR15MB4370.namprd15.prod.outlook.com>
Resent-From: ietf-http-wg@w3.org
X-Mailing-List: <ietf-http-wg@w3.org> archive/latest/52072
X-Loop: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list
List-Id: <ietf-http-wg.w3.org>
List-Help: <https://www.w3.org/email/>
List-Post: <mailto:ietf-http-wg@w3.org>
List-Unsubscribe: <mailto:ietf-http-wg-request@w3.org?subject=unsubscribe>

--_000_SA1PR15MB4370490422595A884B57EED3B3A52SA1PR15MB4370namp_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

The draft "Security Considerations for Optimistic Use of HTTP Upgrade" was =
recently adopted by the working group.  I've published a clean rename of th=
e draft, and written Pull Requests for three changes based on feedback from=
 the working group before and during the adoption call [1].

#2821 - Extend the draft to cover HTTP CONNECT

As Mike Bishop pointed out to me, most of the concerns in this draft, which=
 was originally motivated by "connect-tcp", also apply to regular CONNECT i=
n HTTP/1.1.  This change would expand the draft to cover Upgrade and CONNEC=
T, changing the title of the draft to "Security Considerations for Optimist=
ic Protocol Transitions in HTTP/1.1".

#2818 - Deprecate the "HTTP" and "TLS" upgrade tokens

From discussion on the list, it seems like we have consensus that "Upgrade:=
 HTTP/2.0" is not a standards-compliant header field.  This PR amends the I=
ANA registry [2] to make that clearer.  It also deprecates "Upgrade: TLS/1.=
2" and marks the corresponding RFC as Historic.

#2827 - Recommend GET for future Upgrade Tokens

This PR depends on #2818.  With those deprecations in place, all remaining =
Upgrade Tokens use the GET method.  This PR makes that a formal recommendat=
ion (SHOULD).

If these changes are of interest, please review them on Github or in this t=
hread.  I'll also be discussing them in the Wednesday session of HTTPBIS at=
 IETF 120.

--Ben Schwartz

[1] https://github.com/httpwg/http-extensions/pulls?q=3Dis%3Apr+is%3Aopen+l=
abel%3Aoptimistic-upgrade
[2] https://www.iana.org/assignments/http-upgrade-tokens/http-upgrade-token=
s.xhtml#:~:text=3Dany%20DIGIT.DIGIT%20(-,e.g.%2C%20%222.0%22,-)

--_000_SA1PR15MB4370490422595A884B57EED3B3A52SA1PR15MB4370namp_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-=
1">
<style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo=
ttom:0;} </style>
</head>
<body dir=3D"ltr">
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
The draft &quot;Security Considerations for Optimistic Use of HTTP Upgrade&=
quot; was recently adopted by the working group.&nbsp; I've published a cle=
an rename of the draft, and written Pull Requests for three changes based o=
n feedback from the working group before and during
 the adoption call [1].</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
<br>
</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
#2821 - Extend the draft to cover HTTP CONNECT</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
<br>
</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
As Mike Bishop pointed out to me, most of the concerns in this draft, which=
 was originally motivated by &quot;connect-tcp&quot;, also apply to regular=
 CONNECT in HTTP/1.1.&nbsp; This change would expand the draft to cover Upg=
rade and CONNECT, changing the title of the draft
 to &quot;Security Considerations for Optimistic Protocol Transitions in HT=
TP/1.1&quot;.</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
<br>
</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
#2818 - Deprecate the &quot;HTTP&quot; and &quot;TLS&quot; upgrade tokens</=
div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
<br>
</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
From discussion on the list, it seems like we have consensus that &quot;Upg=
rade: HTTP/2.0&quot; is not a standards-compliant header field.&nbsp; This =
PR amends the IANA registry [2] to make that clearer.&nbsp; It also depreca=
tes &quot;Upgrade: TLS/1.2&quot; and marks the corresponding RFC
 as Historic.</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
<br>
</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
#2827 - Recommend GET for future Upgrade Tokens</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
<br>
</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
This PR depends on #2818.&nbsp; With those deprecations in place, all remai=
ning Upgrade Tokens use the GET method.&nbsp; This PR makes that a formal r=
ecommendation (SHOULD).</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
<br>
</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
If these changes are of interest, please review them on Github or in this t=
hread.&nbsp; I'll also be discussing them in the Wednesday session of HTTPB=
IS at IETF 120.</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
<br>
</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
--Ben Schwartz</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
<br>
</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
[1] <a href=3D"https://github.com/httpwg/http-extensions/pulls?q=3Dis%3Apr+=
is%3Aopen+label%3Aoptimistic-upgrade" id=3D"LPlnk299721" class=3D"OWAAutoLi=
nk">
https://github.com/httpwg/http-extensions/pulls?q=3Dis%3Apr+is%3Aopen+label=
%3Aoptimistic-upgrade</a></div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
[2] <a href=3D"https://www.iana.org/assignments/http-upgrade-tokens/http-up=
grade-tokens.xhtml#:~:text=3Dany%20DIGIT.DIGIT%20(-,e.g.%2C%20%222.0%22,-)"=
 id=3D"LPlnk519904">
https://www.iana.org/assignments/http-upgrade-tokens/http-upgrade-tokens.xh=
tml#:~:text=3Dany%20DIGIT.DIGIT%20(-,e.g.%2C%20%222.0%22,-)</a></div>
</body>
</html>

--_000_SA1PR15MB4370490422595A884B57EED3B3A52SA1PR15MB4370namp_--