Subject: Re: [websec] ignoring STS header fields with undefined directives (was: new rev: draft-ietf-websec-strict-transport-sec-08)

From: =JeffH <[email-masked]>
Date: Fri, 01 Jun 2012 11:32:05 -0700

> Most of my issues were addressed in the latest version, except for this one:
 >
 >  > 6.1.  Strict-Transport-Security HTTP Response Header Field
 >  >
 >  > 4.  UAs MUST ignore any STS header fields containing directives, or
 >  >      other header field value data, that does not conform to the
 >  >      syntax defined in this specification.
 >
 > So this is saying that syntactically invalid STS header fields are
 > to be ignored. This still doesn't say if unrecognized directives are to
 > be ignored or not. (Because they can comply with the generic syntax for
 > directives, so they would be syntactically valid, albeit unrecognized).
 > So can you please add an explicit sentence about that?

Here's the text in my working copy for that item..

             <t>
               UAs MUST ignore any STS header fields containing
               directives, or other header field value data, that does
               not conform to the syntax defined in this specification.
               UAs MUST also ignore any STS header fields containing
               undefined directives.
             </t>

Ok?

thanks,

=JeffH

---

From: Julian Reschke <[email-masked]>
Date: Fri, 01 Jun 2012 21:49:29 +0200

On 2012-06-01 20:32, =JeffH wrote:
> ...

That makes it basically impossible to add extensions; is that intended?

Best regards, Julian

---

From: Alexey Melnikov <[email-masked]>
Date: Fri, 01 Jun 2012 21:33:43 +0100

>               UAs MUST also ignore any STS header fields containing

I agree with Julian: this will make the header field effectively non 
extensible. And if you update the header field by adding new values, all 
older implementations will start ignoring it, which is a deployment 
headache.

But if the WG thinks that that is the way to go...

---

From: Chris Palmer <[email-masked]>
Date: Fri, 1 Jun 2012 14:02:42 -0700

> older implementations will start ignoring it, which is a deployment

For public key pinning, I'm allowing undefined directives in my
implementation. I should check that I'm explicit about that in the
I-D, come to think of it...