[Rats] Re: draft-ietf-rats-coserv-07 early Httpdir review

[Mark Nottingham <[e-mail]>]

Hi Paul,

> On 24 Aug 2026, at 10:30 am, Paul Howard <[e-mail]> wrote:
> 
> PH> To clarify, the intention here would be to disallow HEAD on the origin​ server only (admittedly not very clear from my post). Lucas’s original review suggested that this would be a reasonable step. CoSERV providers are not general-purpose web servers, so the constraint on those ought to be valid, but wouldn’t apply to infrastructure.

I don't think that helps. On a cache miss the origin 405s; on a hit, an intermediary may well answer the HEAD from what it already has. So what a client sees depends on the state of a cache it can't see -- the requirement doesn't produce any behaviour a client can rely on, it just makes deployments differ from each other.

Also, "general-purpose" isn't a property of your intent -- it's a property of what you're deployed on. Go's net/http dispatches HEAD to the GET handler and drops the content; the Java servlet API and most Python frameworks do the same. You'd be asking implementers to disable behaviour their stack gives them for free.

And I don't think the underlying rationale holds up. The concern was HEAD giving clients a cheap way to trigger expensive query computation -- but a GET triggers exactly the same work at the origin. Disallowing HEAD doesn't remove that cost, it just removes one of the two ways of asking for it. If the cost of serving queries is a concern, it needs addressing regardless of method.

I'd say nothing about HEAD at all. 

Cheers,

--
Mark Nottingham   https://mnot.net/