Subject: Re: [websec] of quoted-string header field param value syntax (was: Strict-Transport-Security syntax redux)

From: =JeffH <[email-masked]>
Date: Sun, 15 Jan 2012 18:50:16 -0800

Thanks for your thoughts,

 > I don't think it matters much what we write in this document.

I overall understand and tend to agree, because I'm doubting we will see much 
if any further extension work for this header field.

 >  However,
 > we can deal with that problem when it comes time to add extension
 > values that actually used quoted-string.

agreed. that's why I'm leaning towards spec'g it with quoted-string at this 
time. It future-proofs the spec at least and we won't have to fight a nit like 
this in Last Calls.

I'm not too worried at this point about user agents not actually implementing 
parsing for as-yet-unspecified-or-even-discussed extension directives for the 
STS header field.

though, I remain curious as to why the STS parsing in Firefox & Chrome is 
apparently each a one-off and doesn't use the more generic HTTP header-field 
parsing routines that are available and which appear to handle quoted-string, 
arbitrary header field parameter ordering, etc.

thanks,

=JeffH

---

From: Julian Reschke <[email-masked]>
Date: Mon, 16 Jan 2012 09:24:02 +0100

On 2012-01-16 03:50, =JeffH wrote:
> ...
> though, I remain curious as to why the STS parsing in Firefox & Chrome
> is apparently each a one-off and doesn't use the more generic HTTP
> header-field parsing routines that are available and which appear to
> handle quoted-string, arbitrary header field parameter ordering, etc.
> ...

Well. One reason for that is that STS is indeed different from other 
header fields (for instance, things like Content-Type, Expect, or 
Cache-Control).

To enable UAs to re-use code, you need to specify the header field so 
that code can indeed be re-used.

Best regards, Julian

---

From: Julian Reschke <[email-masked]>
Date: Mon, 16 Jan 2012 10:56:06 +0100

> that code can indeed be re-used.

Expanding on that...

If STS used commas as delimiter (so use the list style), it could be 
compatible with Expect 
(<http://greenbytes.de/tech/webdav/draft-ietf-httpbis-p2-semantics-latest.html#header.expect>) 
and Prefer (<https://tools.ietf.org/html/draft-snell-http-prefer>), and 
would be similar to Cache-Control (minus legacy quirks).

But it uses semicolon, which makes it more similar to things like 
Content-Type, Content-Disposition and Link (RFC 5988). These header 
fields however describe a single item plus parameters, not multiple items.

Best regards, Julian

---

From: Julian Reschke <[email-masked]>
Date: Mon, 16 Jan 2012 15:05:40 +0100

> handle quoted-string, arbitrary header field parameter ordering, etc.

-> <https://bugzilla.mozilla.org/show_bug.cgi?id=718409>

Best regards, Julian