Re: [OAUTH-WG] Improper use of 'Pragma: no-cache' response header in OAuth 2.0 RFCs?

[Brian Campbell <[e-mail]>]

I know it's kind of a trivial issue but I was hoping that at least a couple
people would either agree with me or explain why I'm wrong.


On Thu, Feb 19, 2015 at 4:47 PM, Brian Campbell <[e-mail]>
wrote:

> Examples in RFC 6750 <http://tools.ietf.org/html/rfc6750> and RFC 6749
> <http://tools.ietf.org/html/rfc6749> as well as some normative text in section
> 5.1 of RFC 6749 <http://tools.ietf.org/html/rfc6749#section-5.1> use a
> "Pragma: no-cache" HTTP response header. However, both RFC 2616
> <http://tools.ietf.org/html/rfc2616#section-14.32> and the shiny new RFC
> 7234 <https://tools.ietf.org/html/rfc7234#section-5.4> make special note
> along the lines of the following to say that it doesn't work as response
> header:
>
>    'Note: Because the meaning of "Pragma: no-cache" in responses is
>     not specified, it does not provide a reliable replacement for
>     "Cache-Control: no-cache" in them.'
>
>
> The header doesn't hurt anything, I don't think, so having it in these
> documents isn't really a problem. But it seems like it'd be better to not
> further perpetuate the "Pragma: no-cache" response header myth in actual
> published RFCs.
>
> So with that said, two questions:
>
> 1) Do folks agree that 6747/6750 are using the "Pragma: no-cache" response
> header inappropriately?
>
> 2) If so, does this qualify as errata?
>