Make Date header not required

Sergey Ponomarev <> Mon, 31 August 2020 15:19 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 0A44A3A1518 for <>; Mon, 31 Aug 2020 08:19:10 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.749
X-Spam-Status: No, score=-2.749 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.249, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id M7if3WYEiQvE for <>; Mon, 31 Aug 2020 08:19:08 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 502213A0C40 for <>; Mon, 31 Aug 2020 08:19:07 -0700 (PDT)
Received: from lists by with local (Exim 4.92) (envelope-from <>) id 1kClXB-0003a4-Kg for; Mon, 31 Aug 2020 15:15:49 +0000
Resent-Date: Mon, 31 Aug 2020 15:15:49 +0000
Resent-Message-Id: <>
Received: from ([]) by with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from <>) id 1kClX8-0003ZJ-VZ for; Mon, 31 Aug 2020 15:15:46 +0000
Received: from ([2607:f8b0:4864:20::32a]) by with esmtps (TLS1.3:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.92) (envelope-from <>) id 1kClX7-0004kh-BA for; Mon, 31 Aug 2020 15:15:46 +0000
Received: by with SMTP id n23so5593808otq.11 for <>; Mon, 31 Aug 2020 08:15:44 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=WUt8W4qNz+Ri51LPSq359lGUahqsyJFzu+JeNk8y9Yc=; b=cTKHL6GdhrpK0F26zSmW2dqOHnuJ1JYH2elkNATYR9oUbg9VSCnAb4ieCzfq3LmBrr o+pnxiIkW+dA8W0a6zBbpG2AaUVd6v//pdMlxHKmAsJtBqRZjTLqZ4N8heRW9AdueLWw 8CjZWZSIp4jzGOIxgcA3QSA6TdYPrJxOIChogeS+fMPmBYgpSaSqpJSNeGVdrYh9/0lb sBN7gIs014axcrPXfCxRnwFDVqdg9e9AgaXxauSNIRKYtEELRBVipRcthnNVpSQ+Ofvn 2rLyzDdZgFXg77KRq6YFKvw21IDQ+OaJuuGSgGDin0IdD8IC25ErhrAf2AUzK2woY1lb Idtw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=WUt8W4qNz+Ri51LPSq359lGUahqsyJFzu+JeNk8y9Yc=; b=A9fA1hZq3fkRXDD2jJF04Q213wW0EWOkqjZv3q0G3sDa3RsCzFuPTOkZQvJgoBOgTH JkIcKTRj3C8bRv12fOzEbJ2mXbhhTwBh3aJHubdshmyDByf/vg6ahRmS7dWJnjNKUpgP 4pW++GtTPK3tWfbA6bCV1t4eSPd4t/RTb0aP8x5NoMhAI3EJ9/UJ4LKcD8WKk7+myb+E 0zbbvIbHyw3wXb7R0C1JAfWlhka0p5osEIynPWgKX2Qt0T1hlXfBQ3v5YzmmIln1fyko RYfwA/dvbxRm2YJ29chVGrktUHb2EExWn1NzG8y/AvgRBsv3QQHGzVZiWWTgA46GLUpi H12g==
X-Gm-Message-State: AOAM532UpLJujuOlTmuHVrLLRkGwAFpNUVi6jodM6APp4MSAXTaW4+Kr Fklgx7L16o5tE8hupmqm8W81BmitoFOOuRBDJ139/fF5NWxo5w==
X-Google-Smtp-Source: ABdhPJzPgRHOqte3arQ6c712t+nviSbsvlBc/2YvTQqYgEuI4mKEQs+vr56zQ8RbIuQG5ec9Tgp+Qnwj2flMiuPonko=
X-Received: by 2002:a05:6830:2096:: with SMTP id y22mr1303608otq.158.1598886933497; Mon, 31 Aug 2020 08:15:33 -0700 (PDT)
MIME-Version: 1.0
From: Sergey Ponomarev <>
Date: Mon, 31 Aug 2020 18:14:57 +0300
Message-ID: <>
To: HTTP Working Group <>
Content-Type: multipart/alternative; boundary="000000000000b50ce805ae2ddf0e"
Received-SPF: pass client-ip=2607:f8b0:4864:20::32a;;
X-W3C-Hub-Spam-Status: No, score=-4.1
X-W3C-Hub-Spam-Report: BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, W3C_AA=-1, W3C_WL=-1
X-W3C-Scan-Sig: 1kClX7-0004kh-BA c2bd14743cf16c7508c111f90bed36b3
Subject: Make Date header not required
Archived-At: <>
X-Mailing-List: <> archive/latest/37980
Precedence: list
List-Id: <>
List-Help: <>
List-Post: <>
List-Unsubscribe: <>

The Date header MUST be added to the response but at the same time it may
be omitted if the origin server doesn't have a good clock. It looks like
the header is useful only if server or client have misconfigured time but
the server also returns an Expires header that uses a fixed date.
That's why the header was replaced with more robust Cache-Control that uses
max-age with relevant time instead of fixed.

Also another real life example of usage of the Date is some clients that
have blocked NTP and they tried to fetch time from or

Both examples of usage are not so popular and in most cases the Date header
is just not needed.
But when implementing a web server you want to be compliant with spec or
just don't know how and where the Date is used exactly.
In the next release of BusyBox httpd server for embedded devices the Date
header can be disabled during a compilation. But this will make the server
non RFC compatible.

Is it possible to change MUST to MAY for the header? And add a note when
the header is really needed.

Sergey Ponomarev