Re: [quicwg/base-drafts] Rework HTTP authority/coalescing again (#4808)

[kaduk <[e-mail]>]

@kaduk approved this pull request.

This is good; thank you.
The minor inline comment might also be addressed in [SEMANTICS] instead of here, I think.

> -that server as being authoritative for all origins with the "https" scheme and a
-host identified in the certificate.  The host must be listed either as the CN
-field of the certificate subject or as a dNSName in the subjectAltName field of
-the certificate; see {{!RFC6125}}.  For a host that is an IP address, the client
-MUST verify that the address appears as an iPAddress in the subjectAltName field
-of the certificate.
-
-If the hostname or address is not present in the certificate, the client MUST
-NOT consider the server authoritative for origins containing that hostname or
-address.  See Section 4.3 of {{!SEMANTICS}} for more detail on authoritative
-access.
+component of the URI.  Upon receiving a server certificate in the TLS handshake,
+the client MUST verify that the certificate is an acceptable match for the URI's
+origin server using the process described in Section 4.3.4 of {{!SEMANTICS}}. If
+the certificate cannot be verified with respect to the URI's origin server, the
+client MUST NOT consider the server authoritative for that origin.

This seems to be the only place that we clearly state that failed verification implies not authoritative.  [SEMANTICS] does talk about attributing authority to a  server based on certificate validation, but in 4.3.3, not 4.3.4.
What we say for "normal" re-use seems to be okay without such a (re)statement, since we just say "don't reuse; open a new connection" which would get us back to the procedures here.  But for server-push we might want to reiterate that failed verification means not authoritative (and then we fall through to the subsequent paragraph for "SHOULD send CANCEL_PUSH" for non-authoritative pushes).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/4808#pullrequestreview-576000242