Re: [webfinger] Server Response language

I went through your items from before, but I didn’t add anything related to 404.  Exactly what text are you proposing again?

I want others to agree with the insertion.  If I didn’t add it, it meant I didn’t feel it was needed.  (That might mean I didn’t consider it carefully enough, I’ll admit.)

Paul

From: James M Snell [mailto:jasnell@gmail.com] 
Sent: Thursday, December 20, 2012 12:24 PM
To: Paul E. Jones
Cc: webfinger@ietf.org; webfinger@googlegroups.com
Subject: Re: [webfinger] Server Response language

This language is fine but the security considerations ought to recognize and briefly discuss the risk of returning 401's vs. 404's (as I had previously suggested). 

On Dec 20, 2012 8:28 AM, "Paul E. Jones" <paulej@packetizer.com> wrote:

Folks,

We had this previously:

“If the client queries the WebFinger server and provides a URI for which the server has no information, the server MUST return a 404 status code.”

Someone posted to the list that we should talk about positive replies and mention that a client might be rejected with a 401.  So, I wrote this text to be appended to the end of that above paragraph:

“If the server is able to provide information in response to a request, it MUST do so using an appropriate 2xx HTTP status code and including the requested representation in the body of the response.  A server MAY also return other HTTP status codes, as appropriate, such as a 401 to indicate that the client is not authorized to issue a request to the server.”

Is this agreeable?  Please suggest wording changes, if not.

Paul

_______________________________________________
webfinger mailing list
webfinger@ietf.org
https://www.ietf.org/mailman/listinfo/webfinger