Re: [webfinger] feedback for multiple "rel"

[Mike Jones <[e-mail]>]

A few thoughts after reading this thread.  First, while space-separating values worked for OAuth scopes (because scope values were a new thing and we could just prohibit them from containing spaces) it wouldn't work as well for "rel" values, since URIs are not a new thing and we can't prohibit them from containing spaces (when represented as %20).  So I believe that the change to use multiple "rel" parameter instead was a good one, and one well supported by the reasoning in the earlier thread on this topic.

To Nov's particular issue, a few thoughts come to mind.  First "rel" is an optimization.  It's legal for a server to ignore all "rel" values and just return everything.  That would be a very simple, if inelegant, solution to the Rails issue you're facing, Nov.

Second, if the work you're doing is scoped to just supporting OpenID Connect discovery, you will never have to support multiple "rel" values.  You'll only be receiving requests without "rel" or with a single "rel" parameter of the form rel=http%3A%2F%2Fopenid.net%2Fspecs%2Fconnect%2F1.0%2Fissuer.  If you're never going to receive multiple "rel" parameters, you can ignore the Rails issue.  Again - inelegant, but practically workable.

                                                            Cheers,
                                                            -- Mike

From: [e-mail] [mailto:[e-mail]] On Behalf Of nov matake
Sent: Saturday, December 22, 2012 8:35 PM
To: Paul E.Jones
Cc: [e-mail]; 'James M Snell'; 'Melvin Carvalho'; 'Dick Hardt'
Subject: Re: [webfinger] feedback for multiple "rel"

Developers who uses my library in their rails project would use that function.
I can't stop them.

Of course, I can ask developers to give raw request object (which includes raw requested url, cookies etc) to my library.
But developers will feel weird to give raw request object only for multiple rel case, I think.

====
# put raw request object
WebFinger.discover @request

# put resource & rel only (I prefer this one)
WebFinger.discover params[:resource], params[:rel]
====

On 2012/12/23, at 13:25, Paul E. Jones <[e-mail]<mailto:[e-mail]>> wrote:


Nov,

Do you absolutely need to use that particular function?  It appears that it returns an associative array where the values are not array (unlike the "cgi" code).  So, if using it is required, this will certainly present a challenge.

I would assume WF is not the first thing to use multiple parameters with the same name.  This has not been encountered before?

Paul

From: nov matake [mailto:[e-mail]<http://gmail.com>]
Sent: Saturday, December 22, 2012 11:16 PM
To: Paul E. Jones
Cc: 'Dick Hardt'; 'James M Snell'; [e-mail]<mailto:[e-mail]>; 'Melvin Carvalho'
Subject: Re: [webfinger] feedback for multiple "rel"

CGI library handle it well.
It returns query values as array even when it's a single value though.

So the issue is Rails (actually it uses Rack::Utils.parse_nested_query) only.
It takes only the last "rel" value.

> require 'rack'
> Rack::Utils.parse_nested_query "rel=a&rel=b"
=> {"rel"=>"b"}


On 2012/12/23, at 11:13, "Paul E. Jones" <[e-mail]<mailto:[e-mail]>> wrote:



Dick, Nov,

I've never written a Ruby program before, but I was quite curious as to whether it was or was not possible to access multiple "rel" parameters.  It appears that is.  Here's my first Ruby program (and my apologies to the developers of Ruby):

#!/bin/ruby

require 'cgi'

cgi = CGI.new

params = cgi.params

# Following appears to show an associative array with values that are arrays
puts params;

# Grab the 'rel' array
rels = params['rel'];

# Display the array
puts rels;

# How many items are in the "rel" array?
count = rels.size
print "Number of rel params: ", count, "\n";

# Can I access each one?
for i in 0..(count-1)
   print "Item ", i, ": ", rels[i], "\n"
end

Here's what I get:

$ ./test "rel=rel1&c=d&rel=rel2&e=f"
{"rel"=>["rel1", "rel2"], "c"=>["d"], "e"=>["f"]}
rel1
rel2
Number of rel params: 2
Item 0: rel1
Item 1: rel2

So, it looks like it works to me.  Is the issue only with Rails?  I'm not going to venture down that path to see what the issue is, but if Ruby can access the data, can't it provide it to Rails in a form that it likes?

Paul

From: Dick Hardt [mailto:[e-mail]<http://gmail.com>]
Sent: Saturday, December 22, 2012 8:40 PM
To: Paul E. Jones
Cc: 'James M Snell'; [e-mail]<mailto:[e-mail]>; 'nov matake'; 'Melvin Carvalho'
Subject: Re: [webfinger] feedback for multiple "rel"

FYI: multiple query string params with the same name are turned into arrays or parsed into arrays in node.js

the following script:

var querystring = require('querystring')
console.log( querystring.parse( 'foo=bar&rel=token1&rel=token2' ) )
console.log( querystring.stringify( {'foo':'bar','rel':['token1','token2']} ) )

outputs:

{ foo: 'bar', rel: [ 'token1', 'token2' ] }
foo=bar&rel=token1&rel=token2

Perhaps Ruby devs should just move to the next cool language? :-)
Seriously though, what does the query string parser do in Ruby?

-- Dick

On Dec 22, 2012, at 5:30 PM, "Paul E. Jones" <[e-mail]<mailto:[e-mail]>> wrote:




That depends on where they're used.  If I tell you the "rel" value is "http://example.com/first one", I don't escape that as I write it.  Or are you saying there is text somewhere that already makes that, as written, illegal?

I'm quite favorable to a space-separated list of rel values in a single rel parameter, too.  I was concerned before that spaces would present an issue, but figured we could either we make spaces illegal in rel values (which we can do since those are fabricated things!) or we double-escape.  My preference is a single escape and a single rel parameter and spaces are illegal in the "rel" values themselves.

But, the forces that be pushed pretty hard to change from &rel=token1%20token to &rel=token1&rel=token2.  At the end of the day, it makes no difference to me since I just need to know which way to deal with it.

So Ruby can really only support only a single parameter with a given name?  It will not collect those into an array or anything?

Paul

From: James M Snell [mailto:[e-mail]<http://gmail.com>]
Sent: Saturday, December 22, 2012 7:51 PM
To: Paul E. Jones
Cc: nov matake; Melvin Carvalho; [e-mail]<mailto:[e-mail]>
Subject: Re: [webfinger] feedback for multiple "rel"

Spaces in rel values are already illegal.. specifically, spaces are disallowed in registered link relations and non-escaped spaces are disallowed in absolute IRI's.. A comma delimited list of rel's is better than multiple individual parameters.. even with the potential need for double encoding.



On Sat, Dec 22, 2012 at 4:00 PM, Paul E. Jones <[e-mail]<mailto:[e-mail]>> wrote:
If we made it a requirement that "rel" values have no spaces (which I would argue is a damn good thing for many reasons) then we would not have to double-encode.

Paul

From: [e-mail]<mailto:[e-mail]> [mailto:[e-mail]<mailto:[e-mail]>] On Behalf Of nov matake
Sent: Saturday, December 22, 2012 11:12 AM
To: Melvin Carvalho

Cc: [e-mail]<mailto:[e-mail]>
Subject: Re: [webfinger] feedback for multiple "rel"

BTW, why double encoding lead "problems with things like canonical urls and search engines"?
Can you provide more details?

If 2 rel included, the response would be different than when only 1 rel given.
So I feel those 2 are not the same, and can be indexed as 2 resources..

On 2012/12/23, at 0:44, Melvin Carvalho <[e-mail]<mailto:[e-mail]>> wrote:


On 22 December 2012 05:48, nov matake <[e-mail]<mailto:[e-mail]>> wrote:
Hi,

I have a comment for they way to specify multiple "rel" values.

As a ruby library developer, my main target is rails developers.
Since rails can't handle multiple same query keys, developers will need to hack query params parser in rails middleware layer.
I can easily imagine it'll be an annoying part to support webfinger in rails.

Is the multiple "rel" case can be a space-delimitered (or some other character) strings like multiple redirect_uri in OAuth2?
Or any reason for putting multiple same keys in query parameters?

each time you delimit a list, you have to be able to escape the delimiter, which can be a pain and also leads to problems with things like canonical urls and search engines

can you use mod_rewrite?


Cheers,

Nov Matake
_______________________________________________
webfinger mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/webfinger



_______________________________________________
webfinger mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/webfinger

_______________________________________________
webfinger mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/webfinger