Opportunistic Security for HTTP

[Kari hurtta <[e-mail]>]

Also

https://tools.ietf.org/html/draft-ietf-httpbis-http2-encryption-07#section-2.1

|   GET /.well-known/http-opportunistic HTTP/1.1
|   Host: www.example.com
|
|   HTTP/1.1 200 OK
|   Content-Type: application/json
|   Connection: close
|
|   {
|     "http://www.example.com": {
|       "tls-ports": [443, 8000],
|       "lifetime": 2592000
|     }
|   }


This seems use HTTP/1.1 over TLS, but on same chapter there was

|   Clients MUST NOT send "http" requests over a connection with the "h2"
|   protocol identifier, unless they have obtained a valid http-
|   opportunistic response for an origin (as per Section 2.3), and:

so there is also mismatch with example.

Also if "http/1.1" protocol identifier is allowed, then
this example really should use absoluteURI and not abs_path.

-----------------------------------------
GET http://www.example.com/.well-known/http-opportunistic HTTP/1.1

HTTP/1.1 200 OK
Content-Type: application/json
Connection: close

{
  "http://www.example.com": {
    "tls-ports": [443, 8000],
    "lifetime": 2592000
  }
}
-----------------------------------------

Scheme is needed on here.


If protocol identifier "http/1.1" is here allowed for 
alternative service advertisement, then there need to 
be requrement for use absoluteURI on HTTP/1.1
requests.

/ Kari Hurtta