Subject: Re: [httpwg/http-extensions] rewrite after discussion (de47d40)

From: HTTP issue updates <[email-masked]>
Date: Wed, 01 Feb 2017 18:30:40 -0800

A client won't be able to tell this, and that is what matters in terms of checking.  You really want to include the remote port at the client.  That leaves a server with the difficult problem of knowing how it is identified, but that's a problem they have already.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/commit/de47d40db2c9ca06eb98678e45ebab3f0253fda4#commitcomment-20707392

---

From: HTTP issue updates <[email-masked]>
Date: Wed, 01 Feb 2017 18:33:02 -0800

Thhpt. Yes.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/commit/de47d40db2c9ca06eb98678e45ebab3f0253fda4#commitcomment-20707408

---

From: HTTP issue updates <[email-masked]>
Date: Wed, 01 Feb 2017 18:34:34 -0800

In being specific, you have avoided a bunch of secondary checks that we might perform on a connection for a given name.  We avoided being specific in HTTP/2 by saying:

> The certificate presented by the server MUST satisfy any checks that the client would perform when forming a new TLS connection for the host in the URI.

That applies here.

The problem with this text is that it is necessary, but not sufficient.  The simplest example being that the SAN could be correct, but the domain name might be pinned to a different intermediate CA.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/commit/de47d40db2c9ca06eb98678e45ebab3f0253fda4#commitcomment-20707417

---

From: HTTP issue updates <[email-masked]>
Date: Wed, 01 Feb 2017 18:36:38 -0800

This is expressed as a delta from the rules in 7540 and elsewhere; they still apply. In particular, this check is being made upon receipt of the origin frame, NOT when the connection is established.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/commit/de47d40db2c9ca06eb98678e45ebab3f0253fda4#commitcomment-20707434

---

From: HTTP issue updates <[email-masked]>
Date: Wed, 01 Feb 2017 19:11:00 -0800

It implies more than that by restating a subset of those rules.  And the same rules need to apply upon receipt of ORIGIN as they do at connection establishment time.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/commit/de47d40db2c9ca06eb98678e45ebab3f0253fda4#commitcomment-20707677

---

From: HTTP issue updates <[email-masked]>
Date: Wed, 01 Feb 2017 19:21:58 -0800

All right, I'll add a "Note that...".

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/commit/de47d40db2c9ca06eb98678e45ebab3f0253fda4#commitcomment-20707749