Re: HTTP router point-of-view concerns

"Poul-Henning Kamp" <phk@phk.freebsd.dk> Fri, 12 July 2013 11:46 UTC

Return-Path: <ietf-http-wg-request@listhub.w3.org>
X-Original-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Delivered-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0132321F9E98 for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Fri, 12 Jul 2013 04:46:55 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.599
X-Spam-Level:
X-Spam-Status: No, score=-10.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cWf-iZM5NfW9 for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Fri, 12 Jul 2013 04:46:48 -0700 (PDT)
Received: from frink.w3.org (frink.w3.org [128.30.52.56]) by ietfa.amsl.com (Postfix) with ESMTP id 87D0F21F9E9C for <httpbisa-archive-bis2Juki@lists.ietf.org>; Fri, 12 Jul 2013 04:46:45 -0700 (PDT)
Received: from lists by frink.w3.org with local (Exim 4.72) (envelope-from <ietf-http-wg-request@listhub.w3.org>) id 1Uxbn0-00082C-ID for ietf-http-wg-dist@listhub.w3.org; Fri, 12 Jul 2013 11:45:30 +0000
Resent-Date: Fri, 12 Jul 2013 11:45:30 +0000
Resent-Message-Id: <E1Uxbn0-00082C-ID@frink.w3.org>
Received: from maggie.w3.org ([128.30.52.39]) by frink.w3.org with esmtp (Exim 4.72) (envelope-from <phk@phk.freebsd.dk>) id 1Uxbms-00081S-LQ for ietf-http-wg@listhub.w3.org; Fri, 12 Jul 2013 11:45:22 +0000
Received: from phk.freebsd.dk ([130.225.244.222]) by maggie.w3.org with esmtp (Exim 4.72) (envelope-from <phk@phk.freebsd.dk>) id 1Uxbmr-0005nw-HC for ietf-http-wg@w3.org; Fri, 12 Jul 2013 11:45:22 +0000
Received: from critter.freebsd.dk (unknown [192.168.48.2]) by phk.freebsd.dk (Postfix) with ESMTP id 1A6EE3EB4E; Fri, 12 Jul 2013 11:44:59 +0000 (UTC)
Received: from critter.freebsd.dk (localhost [127.0.0.1]) by critter.freebsd.dk (8.14.7/8.14.7) with ESMTP id r6CBitDI001773; Fri, 12 Jul 2013 11:44:55 GMT (envelope-from phk@phk.freebsd.dk)
To: Mark Nottingham <mnot@mnot.net>
cc: Sam Pullara <spullara@gmail.com>, James M Snell <jasnell@gmail.com>, Martin Thomson <martin.thomson@gmail.com>, Amos Jeffries <squid3@treenet.co.nz>, HTTP Working Group <ietf-http-wg@w3.org>
In-reply-to: <CD9E163F-1225-4DA8-9982-8BDBD16B1051@mnot.net>
From: Poul-Henning Kamp <phk@phk.freebsd.dk>
References: <CA+qvzFPUpcm6kUtJx+rTw8Dpp4Gtx4Bmr3XPDhjNsjchUfN9_w@mail.gmail.com> <51DE1E32.9010801@treenet.co.nz> <CAP+FsNdcYhA=V5Z+zbt70b5e7WmcmXgjG5M9L3vfXeXfTwmRnw@mail.gmail.com> <51DE327C.7010901@treenet.co.nz> <CABkgnnXeqD6wh0dcJ1Dz=4PLAJNkDeGcCuzMr9ATd_7xS7nbGQ@mail.gmail.com> <CABP7RbcUkLf3CTAB4jwicnsiKWLGVY6=hX0k=0256SR_gcVt9A@mail.gmail.com> <092D65A8-8CB7-419D-B6A4-77CAE40A0026@gmail.com> <3835.1373612286@critter.freebsd.dk> <CD9E163F-1225-4DA8-9982-8BDBD16B1051@mnot.net>
Content-Type: text/plain; charset="ISO-8859-1"
Date: Fri, 12 Jul 2013 11:44:55 +0000
Message-ID: <1772.1373629495@critter.freebsd.dk>
Received-SPF: none client-ip=130.225.244.222; envelope-from=phk@phk.freebsd.dk; helo=phk.freebsd.dk
X-W3C-Hub-Spam-Status: No, score=-3.6
X-W3C-Hub-Spam-Report: AWL=-3.288, RP_MATCHES_RCVD=-0.303
X-W3C-Scan-Sig: maggie.w3.org 1Uxbmr-0005nw-HC cb0c95c845074aa349be34a515a0dfa7
X-Original-To: ietf-http-wg@w3.org
Subject: Re: HTTP router point-of-view concerns
Archived-At: <http://www.w3.org/mid/1772.1373629495@critter.freebsd.dk>
Resent-From: ietf-http-wg@w3.org
X-Mailing-List: <ietf-http-wg@w3.org> archive/latest/18721
X-Loop: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list
List-Id: <ietf-http-wg.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Post: <mailto:ietf-http-wg@w3.org>
List-Unsubscribe: <mailto:ietf-http-wg-request@w3.org?subject=unsubscribe>

In message <CD9E163F-1225-4DA8-9982-8BDBD16B1051@mnot.net>, Mark Nottingham wri
tes:

>This has been brought up a number of times. I think what we need is a =
>concrete proposal *with* a detailed plan for a workable transition to =
>the new mechanism -- which seems to be the (or at least one) sticking =
>point whenever this comes up.

I have given a concrete example multiple times, it's very simple:

	The client always sends along a session-identifier of N (128?)
	bits.

	If the first bit is zero, this is an anonymous, transient
	session, not (to be) associated with any other session.

	If the first bit is one, this is a persistent session
	identifier, which the server can use to look up any relevant
	state or information from previous instances of this
	session, in its local database.

	This replaces the Cookie: and Set-Cookie: headers, which
	SHALL NOT be sent in the HTTP/2.0 protocol.

Advantages:

	We get a fixed size session-identifier for HTTP routers to
	use for flow-routing.

	We get an actual (client controlled) session-concept, rather
	than all sorts of ad-hoc simulations with cookies.

	Data with privacy-concerns are stored on the server not on
	random clients the user happens to borrow or use.

	The overhead of encrypting and signing the data in cookies
	is avoided, since they are stored on the server side where
	nobody can fudge them.

Backwards compatibility:

	It should be obvious that simulating the Cookie concept for
	framework compatibility on the server side is a trivial
	matter of programming:  Rather than send set-cookies, write
	them to a database, indexed by the session-id.  Rather than
	receive Cookie: headers, look them up in the database.

There, solved.

Again.

-- 
Poul-Henning Kamp       | UNIX since Zilog Zeus 3.20
phk@FreeBSD.ORG         | TCP/IP since RFC 956
FreeBSD committer       | BSD since 4.3-tahoe    
Never attribute to malice what can adequately be explained by incompetence.