Subject: Re: [httpwg/http-extensions] Definition of Expect-CT is a little unclear (#318)

From: HTTP issue updates <[email-masked]>
Date: Fri, 14 Apr 2017 11:55:33 -0700

Sorry for my delay here.

If I'm understanding correctly, then @royfielding's first suggestion is the intention: it's supposed to be a list of directives, some of which may be name=value:
```
   Expect-CT       = #directive
   directive       = directive-name [ "=" directive-value ]
   directive-name  = token
   directive-value = token / quoted-string
```

However this changes the format from semicolon-separated directives (`Expect-CT: enforce; max-age=23`) to comma-separated (`Expect-CT: enforce, max-age=23`); is that correct?

If so it's a little unfortunate that it'll differ from HPKP/HSTS syntax, which is semicolon-separated directives, but I suppose that's okay. @jcjones how do you feel about that from a Firefox implementation perspective?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/318#issuecomment-294214121

---

From: HTTP issue updates <[email-masked]>
Date: Fri, 14 Apr 2017 13:10:05 -0700

@estark37: Implementation-wise, it's not much work to accept a comma-delimited list instead of semicolons. However, since this is so similar to CSP/HPKP/HSTS, I'd _prefer_ it to have a similar structure of semicolon delineation, particularly since the reporting mechanism looks so much like CSP. It feels like it'd be weird to see the different delimiters side-by-side:

```
    add_header	           Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
    add_header             Content-Security-Policy "default-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' 'self' ... ; img-src data: 'self'; ... ";
    add_header             Expect-CT "enforce, max-age=1";
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/318#issuecomment-294227002

---

From: HTTP issue updates <[email-masked]>
Date: Sun, 16 Apr 2017 12:22:57 -0700

Yes, comma-separated lists is the normal form in HTTP (inherited from the Internet message syntax of email and netnews) because it allows multiple header fields to be appended without changing the semantics of the field. In other words,
```
Expect-CT: enforce, max-age=23
```
is defined by HTTP to be equivalent to   
```
Expect-CT: enforce
Expect-CT: max-age=23
```
which allows various implementation layers/filters to add to a message without rewriting the entire header block.

If the comma-separated list syntax is not used, then implementations are forbidden from sending the directives in more than one field and recipients must fail-with-error if more than one field is received.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/318#issuecomment-294369176

---

From: HTTP issue updates <[email-masked]>
Date: Tue, 18 Apr 2017 00:39:29 -0700

STS, like Cookie, is a bad example of a microsyntax that doesn't take advantage of the HTTP-native features.

Using the non-standard syntax can run afoul of some of the compression measures in HTTP/2.

CSP is actually specifically defined as a single string, so the semi-colons are internal to the header field.  Note that CSP actively forbids multiple header field values (or makes them all apply equally, I can't remember).  In the ways that matter, CSP is actually perfectly compatible with Roy's suggestion.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/318#issuecomment-294715513

---

From: HTTP issue updates <[email-masked]>
Date: Tue, 18 Apr 2017 10:29:02 -0700

Alright, like @jcjones I find it weird that the syntax will be different than HSTS/HPKP/CSP, but I suppose that's okay; Expect-CT will already differ in a couple other subtle ways so I think the syntax difference is not the end of the world.

@martinthomson @royfielding @reschke could you please check if https://github.com/httpwg/http-extensions/pull/327 seems reasonable?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/318#issuecomment-294919228

---

From: HTTP issue updates <[email-masked]>
Date: Thu, 20 Apr 2017 10:00:50 -0700

Closed #318.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/318#event-1050942133