Subject: [webfinger] Server Response language

From: "Paul E. Jones" <[email-masked]>
Date: Thu, 20 Dec 2012 11:28:04 -0500

Folks,

We had this previously:

"If the client queries the WebFinger server and provides a URI for which the
server has no information, the server MUST return a 404 status code."

Someone posted to the list that we should talk about positive replies and
mention that a client might be rejected with a 401.  So, I wrote this text
to be appended to the end of that above paragraph:

"If the server is able to provide information in response to a request, it
MUST do so using an appropriate 2xx HTTP status code and including the
requested representation in the body of the response.  A server MAY also
return other HTTP status codes, as appropriate, such as a 401 to indicate
that the client is not authorized to issue a request to the server."

Is this agreeable?  Please suggest wording changes, if not.

Paul

---

From: James M Snell <[email-masked]>
Date: Thu, 20 Dec 2012 09:24:08 -0800

This language is fine but the security considerations ought to recognize
and briefly discuss the risk of returning 401's vs. 404's (as I had
previously suggested).
On Dec 20, 2012 8:28 AM, "Paul E. Jones" <[email-masked]> wrote:

> Folks,****
>
> ** **
>
> We had this previously:****
>
> ** **
>
> “If the client queries the WebFinger server and provides a URI for which
> the server has no information, the server MUST return a 404 status code.”*
> ***
>
> ** **
>
> to be appended to the end of that above paragraph:****
>
> ** **
>
> “If the server is able to provide information in response to a request, it
> that the client is not authorized to issue a request to the server.”****
>
> ** **
>
> Is this agreeable?  Please suggest wording changes, if not.****
>
> ** **
>
> Paul****
>
> ** **
>
> ** **
>
> _______________________________________________
> webfinger mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/webfinger
>
>

---

From: Tim Bray <[email-masked]>
Date: Thu, 20 Dec 2012 09:29:36 -0800

As in every other case where the WebFinger spec is merely re-iterating
standard HTTP rules, I suggest just removing this language. -Tim

---

From: "Paul E. Jones" <[email-masked]>
Date: Thu, 20 Dec 2012 12:35:16 -0500

The 404 bit is needed, since the "webfinger" server was found. just not the
resource being queried.  That question absolutely will come up.

The new stuff (401, 2xx), I agree: it's re-stating what HTTP does.

If others agree, I'll not put that into the spec.

Paul

From: Tim Bray [mailto:[email-masked]] 
Sent: Thursday, December 20, 2012 12:30 PM
To: Paul E. Jones
Cc: [email-masked]; [email-masked]
Subject: Re: [webfinger] Server Response language

On Thu, Dec 20, 2012 at 8:28 AM, Paul E. Jones <[email-masked]>
wrote:

Folks,

We had this previously:

Paul

---

From: "Paul E. Jones" <[email-masked]>
Date: Thu, 20 Dec 2012 12:37:18 -0500

I went through your items from before, but I didn’t add anything related to 404.  Exactly what text are you proposing again?

I want others to agree with the insertion.  If I didn’t add it, it meant I didn’t feel it was needed.  (That might mean I didn’t consider it carefully enough, I’ll admit.)

Paul

From: James M Snell [mailto:[email-masked]] 
Sent: Thursday, December 20, 2012 12:24 PM
To: Paul E. Jones
Cc: [email-masked]; [email-masked]
Subject: Re: [webfinger] Server Response language

This language is fine but the security considerations ought to recognize and briefly discuss the risk of returning 401's vs. 404's (as I had previously suggested). 

Folks,

We had this previously:

“If the client queries the WebFinger server and provides a URI for which the server has no information, the server MUST return a 404 status code.”

Someone posted to the list that we should talk about positive replies and mention that a client might be rejected with a 401.  So, I wrote this text to be appended to the end of that above paragraph:

“If the server is able to provide information in response to a request, it MUST do so using an appropriate 2xx HTTP status code and including the requested representation in the body of the response.  A server MAY also return other HTTP status codes, as appropriate, such as a 401 to indicate that the client is not authorized to issue a request to the server.”

Paul

---

From: Tim Bray <[email-masked]>
Date: Thu, 20 Dec 2012 09:52:33 -0800

That’s what 404 is for; I quote RFC2616:

10.4.5 404 Not Found

   The server has not found anything matching the Request-URI.

It’s bad practice to incorporate referenced specifications by value not by
reference.  -T

On Thu, Dec 20, 2012 at 9:35 AM, Paul E. Jones <[email-masked]>wrote:

> The 404 bit is needed, since the “webfinger” server was found… just not
> the resource being queried.  That question absolutely will come up.****
>
> ** **
>
> The new stuff (401, 2xx), I agree: it’s re-stating what HTTP does.****
>
> ** **
>
> If others agree, I’ll not put that into the spec.****
>
> ** **
>
> Paul****
>
> ** **
>
> *From:* Tim Bray [mailto:[email-masked]]
> *Sent:* Thursday, December 20, 2012 12:30 PM
> *To:* Paul E. Jones
> *Cc:* [email-masked]; [email-masked]
> *Subject:* Re: [webfinger] Server Response language****
>
> ** **
>
> standard HTTP rules, I suggest just removing this language. -Tim****
>
> wrote:****
>  ****
>  ****
>  ****
>  ****
>  ****
>  ****
>  ****
>  ****
> https://www.ietf.org/mailman/listinfo/webfinger****
>
> ** **
>

---

From: Goix Laurent Walter <[email-masked]>
Date: Thu, 20 Dec 2012 18:58:18 +0100

Le 20 déc. 2012 à 18:53, "Tim Bray" <[email-masked]<mailto:[email-masked]>> a écrit :

10.4.5 404 Not Found

It’s bad practice to incorporate referenced specifications by value not by reference.  -T

Agreed. It's a pity the same was not adopted for jrd ;)

On Thu, Dec 20, 2012 at 9:35 AM, Paul E. Jones <[email-masked]<mailto:[email-masked]>> wrote:
The 404 bit is needed, since the “webfinger” server was found… just not the resource being queried.  That question absolutely will come up.

The new stuff (401, 2xx), I agree: it’s re-stating what HTTP does.

If others agree, I’ll not put that into the spec.

Paul

From: Tim Bray [mailto:[email-masked]<mailto:[email-masked]>]
Sent: Thursday, December 20, 2012 12:30 PM
To: Paul E. Jones
Cc: [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: Re: [webfinger] Server Response language

As in every other case where the WebFinger spec is merely re-iterating standard HTTP rules, I suggest just removing this language. -Tim
On Thu, Dec 20, 2012 at 8:28 AM, Paul E. Jones <[email-masked]<mailto:[email-masked]>> wrote:
Folks,

We had this previously:

Paul

_______________________________________________
webfinger mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/webfinger

_______________________________________________
webfinger mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/webfinger
Questo messaggio e i suoi allegati sono indirizzati esclusivamente alle persone indicate. La diffusione, copia o qualsiasi altra azione derivante dalla conoscenza di queste informazioni sono rigorosamente vietate. Qualora abbiate ricevuto questo documento per errore siete cortesemente pregati di darne immediata comunicazione al mittente e di provvedere alla sua distruzione, Grazie.

This e-mail and any attachments is confidential and may contain privileged information intended for the addressee(s) only. Dissemination, copying, printing or use by anybody else is unauthorised. If you are not the intended recipient, please delete this message and any attachments and advise the sender by return e-mail, Thanks.

Rispetta l'ambiente. Non stampare questa mail se non è necessario.

---

From: "Paul E. Jones" <[email-masked]>
Date: Thu, 20 Dec 2012 13:02:59 -0500

But there server did find something.  It found the "webfinger" resource.
The software that responds to the query has to then decided what it returns.
It might be logical to some, but I'd argue we need to state this to avoid
confusion.

I don't think 2xx or 401 needs to be stated, though.

Paul

From: Tim Bray [mailto:[email-masked]] 
Sent: Thursday, December 20, 2012 12:53 PM
To: Paul E. Jones
Cc: [email-masked]; [email-masked]
Subject: Re: [webfinger] Server Response language

That's what 404 is for; I quote RFC2616:

10.4.5 404 Not Found

It's bad practice to incorporate referenced specifications by value not by
reference.  -T

On Thu, Dec 20, 2012 at 9:35 AM, Paul E. Jones <[email-masked]>
wrote:

Paul

Folks,

We had this previously:

Paul