[quicwg/base-drafts] move security-critical client requirement on push to definitive sections (#4101)

["Roy T. Fielding" <[e-mail]>]

In the HTTP/3 draft 30, section 4.4 on Server Push says

```
   The server MUST include a value in the ":authority" pseudo-header
   field for which the server is authoritative; see Section 3.4.

   Clients SHOULD send a CANCEL_PUSH frame upon receipt of a
   PUSH_PROMISE frame carrying a request that is not cacheable, is not
   known to be safe, that indicates the presence of a request body, or
   for which it does not consider the server authoritative.
```

and then adds in 10.4 (https://tools.ietf.org/html/draft-ietf-quic-http-30#section-10.4)

```
   Pushed responses for which an origin server is not authoritative (see
   Section 3.4) MUST NOT be used or cached.
```

I don't think normative requirements belong in security considerations except in reference to that requirement elsewhere. Also, requirements in general should clearly state who is responsible for implementing them, whereas the latter requirement implies a client (maybe). And sending CANCEL_PUSH is kind of like the MUST NOT, but not really the same thing; it seems a bit weak in response given that the server just tried to poison the client.

I think the server MUST is an interop requirement because the client MUST NOT is a critical security requirement. I think both should be described in Server Push and merely noted in the Security Considerations, since they are really important. Way more important than the spec reads now.

My guess is that this is editorial, but is the kind of thing that should be fixed before IESG last call.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4101