Re: [webfinger] Server Response language

This language is fine but the security considerations ought to recognize
and briefly discuss the risk of returning 401's vs. 404's (as I had
previously suggested).
On Dec 20, 2012 8:28 AM, "Paul E. Jones" <paulej@packetizer.com> wrote:

> Folks,****
>
> ** **
>
> We had this previously:****
>
> ** **
>
> “If the client queries the WebFinger server and provides a URI for which
> the server has no information, the server MUST return a 404 status code.”*
> ***
>
> ** **
>
> Someone posted to the list that we should talk about positive replies and
> mention that a client might be rejected with a 401.  So, I wrote this text
> to be appended to the end of that above paragraph:****
>
> ** **
>
> “If the server is able to provide information in response to a request, it
> MUST do so using an appropriate 2xx HTTP status code and including the
> requested representation in the body of the response.  A server MAY also
> return other HTTP status codes, as appropriate, such as a 401 to indicate
> that the client is not authorized to issue a request to the server.”****
>
> ** **
>
> Is this agreeable?  Please suggest wording changes, if not.****
>
> ** **
>
> Paul****
>
> ** **
>
> ** **
>
> _______________________________________________
> webfinger mailing list
> webfinger@ietf.org
> https://www.ietf.org/mailman/listinfo/webfinger
>
>