Re: [websec] Strict-Transport-Security syntax redux

[Julian Reschke <[e-mail]>]

On 2011-12-30 10:13, Adam Barth wrote:
> Using quoted-string in the extension directive is the wrong thing to
> do.  Because none of the actual directives use quoted-string, folks
> are likely to write parsers that don't handle all the complexities of
> quoted-string (which are legion).  That means when we go to actually
> use quoted-string in a future directive, it won't actually work in
> many user agents.

Unless we clarify the syntax, allow q-s everywhere, and have test cases.

> On the other hand, if we spec the extension directives without
> quoted-string, future extensions will work even if folks mistakenly
> implement quote-string (because DQUOTE is forbidden in the extension
> syntax I suggested above, so we'll never trigger the mistaken
> quoted-string parsing code).  Everyone lives a happy life.

Absolutely not.

First of all, some implementations will parse q-s, because that's 
consistent with other header fields. Also, not having q-s makes certain 
values impossible to send, in which case you'll need to invent yet 
another escaping syntax.

> Anyway, it's all somewhat of a moot point because the above will
> happen regardless of what we write in the spec.  Even if we write
> quoted-string, when folks attempt to use these extension directives in
> the future, they'll find that they don't work and they'll update the
> syntax not to use quoted-string.

Why would they find that? Implementations can be fixed.

Or is this argument based on the fact that you *currently* "own" one 
implementation and claim it can't be fixed? That would be a very strange 
thing to do in the context of an IETF WG trying to reach consensus.

Best regards, Julian

PS: I note that we are in violent agreement that the syntax should be 
the same for all directives, predefined or extension. We just come to 
different conclusions about what that syntax should be.