Subject: [httpwg/http-extensions] Updated Opp-Sec writeup (#297)

From: HTTP issue updates <[email-masked]>
Date: Wed, 15 Feb 2017 15:29:42 -0800

For git tracking purposes, even though I'm uploading directly to Datatracker as well.
You can view, comment on, or merge this pull request online at:

  https://github.com/httpwg/http-extensions/pull/297

-- Commit Summary --

  * Updated Opp-Sec writeup

-- File Changes --

    M writeups/opp-sec.md (104)

-- Patch Links --

https://github.com/httpwg/http-extensions/pull/297.patch
https://github.com/httpwg/http-extensions/pull/297.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/pull/297

---

From: HTTP issue updates <[email-masked]>
Date: Wed, 15 Feb 2017 16:11:37 -0800

martinthomson commented on this pull request.

> +
+RFC 7838 requires "reasonable assurances" that the alternative was under the
+control of the same authority as the origin. RFC 7838 defines only one means of
+having such assurance: possession of a TLS certificate for the origin. After
+much discussion, this draft maintains that definition and requires the use of
+fully verified certificates.
+
+The other item of particular concern around using RFC7838 with http:// URIs was
+server support for receiving requests for http:// schemed resources on ports
+configured to use TLS. While HTTP/1.1 might permit and HTTP/2 mandates the
+inclusion of the URL scheme with the request, it appears that almost no server
+implementations treat the included scheme as more authoritative than the port on
+which it was received. This is noted in section 4.4. As a result, the final
+version of this document prohibits the use of HTTP/1.1 and uses the .well-known
+resource as a server's self-certification that it can correctly distinguish such
+requests.

You might also note the added prohibition on "coalescing".

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/pull/297#pullrequestreview-22145044