Re: [websec] Last Call: <draft-ietf-websec-origin-04.txt> (The Web Origin Concept) to Proposed Standard

[Frank Ellermann <[e-mail]>]

On 2 September 2011 23:15, Roy T. Fielding wrote:

>> this is still "avoid *any* folding", and not "avoid more
>> than one folding".

> That is the intention.  There is no reason to fold in HTTP
> outside of the message/http media type.

As a result you get an intentional difference from <obs-FWS>
in messages, because HTTP has no line length limit.  This
<obs-FWS> is about "insane" foldings, and your <obs-fold> is
about "unnecessary or insane" foldings.

I'm not sure that a sound but unnecessary folding is really
always a bad idea, e.g., I don't use programming languages
with a hardwired maximal string length, where "unnecessary"
could turn out to be "rarely almost required".

Still only "JFTR", if you are sure that this is precisely as
you want it stick to it.  The more spectacular examples with
"syntactically valid ASCII art consisting of commas" will be
obsoleted by <obs-fold>, while <obs-FWS> alone only tackles
the dangerous "apparently empty" lines -- but IIRC RFC 5322
also did something else about ASCII art.

>> I wonder why you don't demote HTAB generally to "obsolete"
>> in OWS.

> We already state that a single SP is preferred.

Two SHOULDs in the prose before the syntax.  If you move HTAB
to obs-fold = HTAB / ( CRLF (HTAB / SP)) and then rename this
to <obs-wsp> it would more closely match the prose, "whatever
you do with one or even more than one SP, stay away from HTAB
and CRLF".

> That said, I'd also agree with Julian's suggestion that it
> is better to just define the field-value in ABNF and leave
> the rest to HTTP.

Yes, the Origin I-D shouldn't define any <OWS> if that is not
guaranteed to be precisely the same as in the future HTTPbis.

-Frank