Re: [hybi] straw-poll on GET vs OPTIONS vs new method

[Gabriel Montenegro <[e-mail]>]

Unfortunately, I can't say which I'd absolutely prefer, but I can say that OPTIONS is at the very bottom.

In other words, my preference is:

#3 (WEBSOCKET) over #2 (OPTIONS)
#1 (GET) over #2 (OPTIONS)

Here's some rationale: 

The point that previous uses of OPTIONS can lead to confusion with previous usage was made in reference to its use in CORS (http://www.w3.org/TR/cors/). There's also WEBDAV (http://tools.ietf.org/html/rfc4918) and others.  This point argues for WEBSOCKET (a brand new method with no other previous usage) over either GET or OPTIONS. 

+1 WEBSOCKET

Even though both GET and OPTIONS have existing usage, they are not equally safe. GET and POST (which are by far the most used) undergo much more scrutiny than other lesser-known or completely arbitrary methods. Lesser methods can be used to exploit vulnerabilities in faulty ACL checking:
http://www.owasp.org/index.php/Testing_for_HTTP_Methods_and_XST_(OWASP-CM-008)#Arbitrary_HTTP_Methods

This argues for GET over either OPTIONS or WEBSOCKET.

+1 GET

The reason why the straw poll was initiated is that it was argued that OPTIONS is what RFC2817 uses.  This is true, but only partly so. RFC2817 uses *both* GET and OPTIONS.

GET is used in an "Optional Upgrade" per http://tools.ietf.org/html/rfc2817#section-3.1. This means that the GET request could be satisfied by the server either (1) without heeding the Upgrade, or (2) by first switching protocols as requested by the Upgrade, and then answering the original request, per the order specified in http://tools.ietf.org/html/draft-ietf-httpbis-p1-messaging-12#section-9.8:
 	
   ... although the first action
   after changing the protocol MUST be a response to the initial HTTP
   request containing the Upgrade header field.

OPTIONS is used in a "Mandatory Upgrade" per http://tools.ietf.org/html/rfc2817#section-3.2. The Upgrade is still optional at the server, of course, but if it's not heeded, the client could abort at this time. This would make the upgrade a precondition to fetching the resource ("mandatory" in that respect).

So RFC2817 is not an argument for either method, but to the use of more than one. The WG seems to have spoken against this, and I agree, it's best to have only one and avoid more complexity.

Another point against GET and OPTIONS is that both are supposed to be idempotent. This has been misconstrued as a requirement to cause no changes at the server. http://tools.ietf.org/html/draft-ietf-httpbis-p2-semantics-12#section-7.1.2 clarifies:

   ...  It is important to
   note that idempotence refers only to changes requested by the client:
   a server is free to change its state due to multiple requests for the
   purpose of tracking those requests, versioning of results, etc.

Since the Upgrade effects a change on the connection, not on the resource, I don't see idempotence as an argument against GET, OPTIONS or any other idempotent method.

That's why I prefer WEBSOCKET or GET (and only one) over OPTIONS. 

Gabriel


> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On Behalf Of
> Salvatore Loreto
> Sent: Friday, January 21, 2011 1:01 AM
> To: [e-mail]
> Cc: Joe Hildebrand; SM
> Subject: [hybi] straw-poll on GET vs OPTIONS vs new method
> 
> 
> Hi there,
> 
> after the result of the first straw-poll on GET+Upgrade+Masking, there were a
> discussion about GET not being the only method to "Upgrade"
> the connection;
> other methods such as OPTIONS
> (http://www.ietf.org/mail-archive/web/hybi/current/msg05721.html)
> and perhaps a completely new method could be used (as proposed months ago).
> 
> All the possibilities have pro and cons.
> 
> The mail thread(s) started to discuss the alternatives, convinced Joe and myself,
> as HyBi wg co-chairs, that it make sense to run a straw-poll to get as much
> information as we can  from people about technical reason (pro and cons) for
> their preference(s).
> 
> 
> So please provide your choices (if more then one, please rank them or if only
> one specify "I can live only with") among the following
> 
> #1 - GET
> #2 - OPTIONS
> #3 - a complete new method (e.g. WEBSOCKET)
> 
> This poll will run until January 31st
> 
> cheers
> /Sal
> 
> --
> Salvatore Loreto
> www.sloreto.com
> 
> _______________________________________________
> hybi mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/hybi