Re: [websec] #60: Well Known URIs vs Response Headers

[Yoav Nir <[e-mail]>]

[no hats]

On Aug 7, 2013, at 12:51 AM, Ryan Sleevi <[e-mail]> wrote:
> 
> 
> In an HTTP/2.0 world, where 'everything' is multiplexed over a single
> logical connection, I would heartily agree that this is less of a concern.
> But in an HTTP/1.0 and HTTP/1.1 world - which will still be here for a
> while - it's a very real concern.

Both ideas get better with HTTP/2.0. the WK URI can be always requested with lowest priority, so it doesn't interfere with loading the web page. And header bloat does not matter that much if the header is included only once per TCP connection.

> For those not familiar with these concerns from the browser/user-agent
> perspective, at the risk of promotion I'd suggest checking out my
> colleague Ilya Grigorik's (presently available free) book "High
> Performance Browser Networking" (
> http://chimera.labs.oreilly.com/books/1230000000545 ), in particular the
> lessons learned, user metrics gained, and graphs discussed in chapters
> 9-13.
> 
> That's not to say that Well-Known URIs are not extremely tempting, for
> some of the reasons already expressed by Joe and Trevor, but I think it
> may be missed some of the downsides that are not necessarily present in
> the current header-based approach.
> 
> In our mind, one of the biggest factors has been "What are the hurdles to
> practical deployment?". While there is admittedly complexity from the
> header approach, it's our view that it's not greater than the inherent
> complexity of effective pinning, as enumerated in the existing
> considerations. The complexity of an efficient and reasonable
> implementation of well-known URIs, or of a practical deployment of server
> extensions, seems to greatly outweigh both, and the benefits are not as
> seemingly significant.

+1

Yoav