[websec] Well-known URIs

[Mark Nottingham <[e-mail]>]

Hi,

I see there's discussion of well-known URIs for Websec over here.

Just a few points that may help… or not.

1. Well-known URIs are designed for cases where the client wants to get a bunch of *related* data together; as such, a general framework is encouraged, as long as the use cases are similar. 

This is why I don't like hostmeta; it's a bucket for anything you want to throw in there, which means that over time, the client will be getting a lot of information they don't want, which will necessitate a query language, which is just nasty overkill. At the other end of the spectrum, having a single-use well-known URI in the critical path (or even not) for a browser is similarly Not A Good Idea.

2. Discovering whether a well-known URI is present on a given host without much overhead is the use case for browser hints: <http://tools.ietf.org/html/draft-nottingham-http-browser-hints-05>.  Looking for a better name for that one…

3. Alternatively, if browsers are pre connecting, they could use the conn to fetch a well-known URI, as long as it was cheap to fetch. That policy file could even control how aggressively the browser pre-connects (two birds, one stone…).

Hope this helps,


--
Mark Nottingham   http://www.mnot.net/