< draft-ietf-httpbis-alt-svc-12.txt   draft-ietf-httpbis-alt-svc-13.txt >
HTTP Working Group M. Nottingham HTTP Working Group M. Nottingham
Internet-Draft Akamai Internet-Draft Akamai
Intended status: Standards Track P. McManus Intended status: Standards Track P. McManus
Expires: August 12, 2016 Mozilla Expires: September 2, 2016 Mozilla
J. Reschke J. Reschke
greenbytes greenbytes
February 9, 2016 March 1, 2016
HTTP Alternative Services HTTP Alternative Services
draft-ietf-httpbis-alt-svc-12 draft-ietf-httpbis-alt-svc-13
Abstract Abstract
This document specifies "Alternative Services" for HTTP, which allow This document specifies "Alternative Services" for HTTP, which allow
an origin's resources to be authoritatively available at a separate an origin's resources to be authoritatively available at a separate
network location, possibly accessed with a different protocol network location, possibly accessed with a different protocol
configuration. configuration.
Editorial Note (To be removed by RFC Editor) Editorial Note (To be removed by RFC Editor)
skipping to change at page 1, line 48 skipping to change at page 1, line 48
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/. Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on August 12, 2016. This Internet-Draft will expire on September 2, 2016.
Copyright Notice Copyright Notice
Copyright (c) 2016 IETF Trust and the persons identified as the Copyright (c) 2016 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
skipping to change at page 3, line 12 skipping to change at page 3, line 12
the Trust Legal Provisions and are provided without warranty as the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License. described in the Simplified BSD License.
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.1. Notational Conventions . . . . . . . . . . . . . . . . . . 4 1.1. Notational Conventions . . . . . . . . . . . . . . . . . . 4
2. Alternative Services Concepts . . . . . . . . . . . . . . . . 5 2. Alternative Services Concepts . . . . . . . . . . . . . . . . 5
2.1. Host Authentication . . . . . . . . . . . . . . . . . . . 7 2.1. Host Authentication . . . . . . . . . . . . . . . . . . . 7
2.2. Alternative Service Caching . . . . . . . . . . . . . . . 7 2.2. Alternative Service Caching . . . . . . . . . . . . . . . 7
2.3. Requiring Server Name Indication . . . . . . . . . . . . . 7 2.3. Requiring Server Name Indication . . . . . . . . . . . . . 8
2.4. Using Alternative Services . . . . . . . . . . . . . . . . 8 2.4. Using Alternative Services . . . . . . . . . . . . . . . . 8
3. The Alt-Svc HTTP Header Field . . . . . . . . . . . . . . . . 9 3. The Alt-Svc HTTP Header Field . . . . . . . . . . . . . . . . 9
3.1. Caching Alt-Svc Header Field Values . . . . . . . . . . . 11 3.1. Caching Alt-Svc Header Field Values . . . . . . . . . . . 11
4. The ALTSVC HTTP/2 Frame . . . . . . . . . . . . . . . . . . . 12 4. The ALTSVC HTTP/2 Frame . . . . . . . . . . . . . . . . . . . 12
5. The Alt-Used HTTP Header Field . . . . . . . . . . . . . . . . 14 5. The Alt-Used HTTP Header Field . . . . . . . . . . . . . . . . 14
6. The 421 Misdirected Request HTTP Status Code . . . . . . . . . 14 6. The 421 Misdirected Request HTTP Status Code . . . . . . . . . 14
7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 14 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 15
7.1. Header Field Registrations . . . . . . . . . . . . . . . . 14 7.1. Header Field Registrations . . . . . . . . . . . . . . . . 15
7.2. The ALTSVC HTTP/2 Frame Type . . . . . . . . . . . . . . . 15 7.2. The ALTSVC HTTP/2 Frame Type . . . . . . . . . . . . . . . 15
7.3. Alt-Svc Parameter Registry . . . . . . . . . . . . . . . . 15 7.3. Alt-Svc Parameter Registry . . . . . . . . . . . . . . . . 15
7.3.1. Procedure . . . . . . . . . . . . . . . . . . . . . . 15 7.3.1. Procedure . . . . . . . . . . . . . . . . . . . . . . 15
7.3.2. Registrations . . . . . . . . . . . . . . . . . . . . 15 7.3.2. Registrations . . . . . . . . . . . . . . . . . . . . 16
8. Internationalization Considerations . . . . . . . . . . . . . 16 8. Internationalization Considerations . . . . . . . . . . . . . 16
9. Security Considerations . . . . . . . . . . . . . . . . . . . 16 9. Security Considerations . . . . . . . . . . . . . . . . . . . 16
9.1. Changing Ports . . . . . . . . . . . . . . . . . . . . . . 16 9.1. Changing Ports . . . . . . . . . . . . . . . . . . . . . . 16
9.2. Changing Hosts . . . . . . . . . . . . . . . . . . . . . . 16 9.2. Changing Hosts . . . . . . . . . . . . . . . . . . . . . . 17
9.3. Changing Protocols . . . . . . . . . . . . . . . . . . . . 17 9.3. Changing Protocols . . . . . . . . . . . . . . . . . . . . 17
9.4. Tracking Clients Using Alternative Services . . . . . . . 17 9.4. Tracking Clients Using Alternative Services . . . . . . . 18
9.5. Confusion Regarding Request Scheme . . . . . . . . . . . . 18 9.5. Confusion Regarding Request Scheme . . . . . . . . . . . . 18
10. References . . . . . . . . . . . . . . . . . . . . . . . . . . 18 10. References . . . . . . . . . . . . . . . . . . . . . . . . . . 19
10.1. Normative References . . . . . . . . . . . . . . . . . . . 18 10.1. Normative References . . . . . . . . . . . . . . . . . . . 19
10.2. Informative References . . . . . . . . . . . . . . . . . . 20 10.2. Informative References . . . . . . . . . . . . . . . . . . 20
Appendix A. Change Log (to be removed by RFC Editor before Appendix A. Change Log (to be removed by RFC Editor before
publication) . . . . . . . . . . . . . . . . . . . . 20 publication) . . . . . . . . . . . . . . . . . . . . 20
A.1. Since draft-nottingham-httpbis-alt-svc-05 . . . . . . . . 20 A.1. Since draft-nottingham-httpbis-alt-svc-05 . . . . . . . . 20
A.2. Since draft-ietf-httpbis-alt-svc-00 . . . . . . . . . . . 20 A.2. Since draft-ietf-httpbis-alt-svc-00 . . . . . . . . . . . 21
A.3. Since draft-ietf-httpbis-alt-svc-01 . . . . . . . . . . . 20 A.3. Since draft-ietf-httpbis-alt-svc-01 . . . . . . . . . . . 21
A.4. Since draft-ietf-httpbis-alt-svc-02 . . . . . . . . . . . 21 A.4. Since draft-ietf-httpbis-alt-svc-02 . . . . . . . . . . . 21
A.5. Since draft-ietf-httpbis-alt-svc-03 . . . . . . . . . . . 21 A.5. Since draft-ietf-httpbis-alt-svc-03 . . . . . . . . . . . 21
A.6. Since draft-ietf-httpbis-alt-svc-04 . . . . . . . . . . . 21 A.6. Since draft-ietf-httpbis-alt-svc-04 . . . . . . . . . . . 21
A.7. Since draft-ietf-httpbis-alt-svc-05 . . . . . . . . . . . 21 A.7. Since draft-ietf-httpbis-alt-svc-05 . . . . . . . . . . . 22
A.8. Since draft-ietf-httpbis-alt-svc-06 . . . . . . . . . . . 21 A.8. Since draft-ietf-httpbis-alt-svc-06 . . . . . . . . . . . 22
A.9. Since draft-ietf-httpbis-alt-svc-07 . . . . . . . . . . . 22 A.9. Since draft-ietf-httpbis-alt-svc-07 . . . . . . . . . . . 22
A.10. Since draft-ietf-httpbis-alt-svc-08 . . . . . . . . . . . 23 A.10. Since draft-ietf-httpbis-alt-svc-08 . . . . . . . . . . . 23
A.11. Since draft-ietf-httpbis-alt-svc-09 . . . . . . . . . . . 23 A.11. Since draft-ietf-httpbis-alt-svc-09 . . . . . . . . . . . 24
A.12. Since draft-ietf-httpbis-alt-svc-10 . . . . . . . . . . . 24 A.12. Since draft-ietf-httpbis-alt-svc-10 . . . . . . . . . . . 24
A.13. Since draft-ietf-httpbis-alt-svc-11 . . . . . . . . . . . 24 A.13. Since draft-ietf-httpbis-alt-svc-11 . . . . . . . . . . . 24
A.14. Since draft-ietf-httpbis-alt-svc-12 . . . . . . . . . . . 24
Appendix B. Acknowledgements . . . . . . . . . . . . . . . . . . 24 Appendix B. Acknowledgements . . . . . . . . . . . . . . . . . . 24
1. Introduction 1. Introduction
HTTP [RFC7230] conflates the identification of resources with their HTTP [RFC7230] conflates the identification of resources with their
location. In other words, "http://" (and "https://") URIs are used location. In other words, "http://" and "https://" URIs are used to
to both name and find things to interact with. both name and find things to interact with.
In some cases, it is desirable to separate identification and In some cases, it is desirable to separate identification and
location in HTTP; keeping the same identifier for a resource, but location in HTTP; keeping the same identifier for a resource, but
interacting with it at a different location on the network. interacting with it at a different location on the network.
For example: For example:
o An origin server might wish to redirect a client to a different o An origin server might wish to redirect a client to a different
server when it is under load, or it has found a server in a server when it is under load, or it has found a server in a
location that is more local to the client. location that is more local to the client.
o An origin server might wish to offer access to its resources using o An origin server might wish to offer access to its resources using
a new protocol (such as HTTP/2, see [RFC7540]) or one using a new protocol, such as HTTP/2 [RFC7540], or one using improved
improved security (such as Transport Layer Security (TLS), see security, such as Transport Layer Security (TLS) [RFC5246].
[RFC5246]).
o An origin server might wish to segment its clients into groups of o An origin server might wish to segment its clients into groups of
capabilities, such as those supporting Server Name Indication capabilities, such as those supporting Server Name Indication
(SNI, see Section 3 of [RFC6066]) and those not supporting it, for (SNI) (Section 3 of [RFC6066]), for operational purposes.
operational purposes.
This specification defines a new concept in HTTP, "Alternative This specification defines a new concept in HTTP, "Alternative
Services", that allows an origin server to nominate additional means Services", that allows an origin server to nominate additional means
of interacting with it on the network. It defines a general of interacting with it on the network. It defines a general
framework for this in Section 2, along with specific mechanisms for framework for this in Section 2, along with specific mechanisms for
advertising their existence using HTTP header fields (Section 3) or advertising their existence using HTTP header fields (Section 3) or
HTTP/2 frames (Section 4), plus a way to indicate that an alternative HTTP/2 frames (Section 4), plus a way to indicate that an alternative
service was used (Section 5). service was used (Section 5).
It also endorses the status code 421 (Misdirected Request) It also endorses the status code 421 (Misdirected Request)
(Section 6) that origin servers (or their nominated alternatives) can (Section 6) that origin servers or their nominated alternatives can
use to indicate that they are not authoritative for a given origin, use to indicate that they are not authoritative for a given origin,
in cases where the wrong location is used. in cases where the wrong location is used.
1.1. Notational Conventions 1.1. Notational Conventions
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119]. document are to be interpreted as described in [RFC2119].
This document uses the Augmented BNF defined in [RFC5234] and updated This document uses the Augmented BNF defined in [RFC5234] and updated
skipping to change at page 5, line 4 skipping to change at page 4, line 51
1.1. Notational Conventions 1.1. Notational Conventions
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119]. document are to be interpreted as described in [RFC2119].
This document uses the Augmented BNF defined in [RFC5234] and updated This document uses the Augmented BNF defined in [RFC5234] and updated
by [RFC7405] along with the "#rule" extension defined in Section 7 of by [RFC7405] along with the "#rule" extension defined in Section 7 of
[RFC7230]. The rules below are defined in [RFC5234], [RFC7230], and [RFC7230]. The rules below are defined in [RFC5234], [RFC7230], and
[RFC7234]: [RFC7234]:
OWS = <OWS, see [RFC7230], Section 3.2.3> OWS = <OWS, see [RFC7230], Section 3.2.3>
delta-seconds = <delta-seconds; see [RFC7234], Section 1.2.1> delta-seconds = <delta-seconds; see [RFC7234], Section 1.2.1>
port = <port, see [RFC7230], Section 2.7> port = <port, see [RFC7230], Section 2.7>
quoted-string = <quoted-string, see [RFC7230], Section 3.2.6> quoted-string = <quoted-string, see [RFC7230], Section 3.2.6>
token = <token, see [RFC7230], Section 3.2.6> token = <token, see [RFC7230], Section 3.2.6>
uri-host = <uri-host, see [RFC7230], Section 2.7> uri-host = <uri-host, see [RFC7230], Section 2.7>
2. Alternative Services Concepts 2. Alternative Services Concepts
This specification defines a new concept in HTTP, the "Alternative This specification defines a new concept in HTTP, the "Alternative
Service". When an origin (see [RFC6454]) has resources that are Service". When an origin [RFC6454] has resources that are accessible
accessible through a different protocol / host / port combination, it through a different protocol / host / port combination, it is said to
is said to have an alternative service available. have an alternative service available.
An alternative service can be used to interact with the resources on An alternative service can be used to interact with the resources on
an origin server at a separate location on the network, possibly an origin server at a separate location on the network, possibly
using a different protocol configuration. Alternative services are using a different protocol configuration. Alternative services are
considered authoritative for an origin's resources, in the sense of considered authoritative for an origin's resources, in the sense of
[RFC7230], Section 9.1. [RFC7230], Section 9.1.
For example, an origin: For example, an origin:
("http", "www.example.com", "80") ("http", "www.example.com", "80")
might declare that its resources are also accessible at the might declare that its resources are also accessible at the
alternative service: alternative service:
("h2", "new.example.com", "81") ("h2", "new.example.com", "81")
By their nature, alternative services are explicitly at the By their nature, alternative services are explicitly at the
granularity of an origin; i.e., they cannot be selectively applied to granularity of an origin; they cannot be selectively applied to
resources within an origin. resources within an origin.
Alternative services do not replace or change the origin for any Alternative services do not replace or change the origin for any
given resource; in general, they are not visible to the software given resource; in general, they are not visible to the software
"above" the access mechanism. The alternative service is essentially "above" the access mechanism. The alternative service is essentially
alternative routing information that can also be used to reach the alternative routing information that can also be used to reach the
origin in the same way that DNS CNAME or SRV records define routing origin in the same way that DNS CNAME or SRV records define routing
information at the name resolution level. Each origin maps to a set information at the name resolution level. Each origin maps to a set
of these routes -- the default route is derived from the origin of these routes -- the default route is derived from the origin
itself and the other routes are introduced based on alternative- itself and the other routes are introduced based on alternative-
skipping to change at page 7, line 9 skipping to change at page 7, line 9
such mechanisms: the "Alt-Svc" HTTP header field (Section 3) and the such mechanisms: the "Alt-Svc" HTTP header field (Section 3) and the
"ALTSVC" HTTP/2 frame type (Section 4). "ALTSVC" HTTP/2 frame type (Section 4).
The remainder of this section describes requirements that are common The remainder of this section describes requirements that are common
to alternative services, regardless of how they are discovered. to alternative services, regardless of how they are discovered.
2.1. Host Authentication 2.1. Host Authentication
Clients MUST have reasonable assurances that the alternative service Clients MUST have reasonable assurances that the alternative service
is under control of and valid for the whole origin. This mitigates is under control of and valid for the whole origin. This mitigates
the attack described in Section 9.2. One way to achieve this is for the attack described in Section 9.2.
the alternative to use TLS with a certificate that is valid for the
origin. For the purposes of this document, "reasonable assurances" can be
established through use of a TLS-based protocol with the certificate
checks defined in [RFC2818]. Other means of establishing them MUST
be documented in an RFC that updates this specification. Clients MAY
impose additional criteria for establishing reasonable assurances.
For example, if the origin's host is "www.example.com" and an For example, if the origin's host is "www.example.com" and an
alternative is offered on "other.example.com" with the "h2" protocol, alternative is offered on "other.example.com" with the "h2" protocol,
and the certificate offered is valid for "www.example.com", the and the certificate offered is valid for "www.example.com", the
client can use the alternative. However, if "other.example.com" is client can use the alternative. However, if either is offered with
offered with the "h2c" protocol, the client cannot use it, because the "h2c" protocol, the client cannot use it, because there is no
there is no mechanism in that protocol to establish the relationship mechanism (at the time of the publication of this specification) in
between the origin and the alternative. that protocol to establish the relationship between the origin and
the alternative.
2.2. Alternative Service Caching 2.2. Alternative Service Caching
Mechanisms for discovering alternative services also associate a Mechanisms for discovering alternative services also associate a
freshness lifetime with them; for example, the Alt-Svc header field freshness lifetime with them; for example, the Alt-Svc header field
uses the "ma" parameter. uses the "ma" parameter.
Clients can choose to use an alternative service instead of the Clients can choose to use an alternative service instead of the
origin at any time when it is considered fresh; see Section 2.4 for origin at any time when it is considered fresh; see Section 2.4 for
specific recommendations. specific recommendations.
Clients with existing connections to an alternative service do not Clients with existing connections to an alternative service do not
need to stop using it when its freshness lifetime ends; i.e., the need to stop using it when its freshness lifetime ends; the caching
caching mechanism is intended for limiting how long an alternative mechanism is intended for limiting how long an alternative service
service can be used for establishing new connections, not limiting can be used for establishing new connections, not limiting the use of
the use of existing ones. existing ones.
Alternative services are fully authoritative for the origin in Alternative services are fully authoritative for the origin in
question, including the ability to clear or update cached alternative question, including the ability to clear or update cached alternative
service entries, extend freshness lifetimes, and any other authority service entries, extend freshness lifetimes, and any other authority
the origin server would have. the origin server would have.
When alternative services are used to send a client to the most When alternative services are used to send a client to the most
optimal server, a change in network configuration can result in optimal server, a change in network configuration can result in
cached values becoming suboptimal. Therefore, clients SHOULD remove cached values becoming suboptimal. Therefore, clients SHOULD remove
from cache all alternative services that lack the "persist" flag with from cache all alternative services that lack the "persist" flag with
the value "1" when they detect such a change (when information about the value "1" when they detect such a change, when information about
network state is available). network state is available.
2.3. Requiring Server Name Indication 2.3. Requiring Server Name Indication
A client MUST only use a TLS-based alternative service if the client A client MUST only use a TLS-based alternative service if the client
also supports TLS Server Name Indication (SNI). This supports the also supports TLS Server Name Indication (SNI). This supports the
conservation of IP addresses on the alternative service host. conservation of IP addresses on the alternative service host.
Note that the SNI information provided in TLS by the client will be Note that the SNI information provided in TLS by the client will be
that of the origin, not the alternative (as will the Host HTTP header that of the origin, not the alternative (as will the Host HTTP header
field value). field value).
2.4. Using Alternative Services 2.4. Using Alternative Services
By their nature, alternative services are OPTIONAL: clients do not By their nature, alternative services are OPTIONAL: clients do not
need to use them. However, it is advantageous for clients to behave need to use them. However, it is advantageous for clients to behave
in a predictable way when alternative services are used by servers in a predictable way when alternative services are used by servers,
(e.g., for load balancing). to aid purposes like load balancing.
Therefore, if a client becomes aware of an alternative service, the Therefore, if a client becomes aware of an alternative service, the
client SHOULD use that alternative service for all requests to the client SHOULD use that alternative service for all requests to the
associated origin as soon as it is available, provided the associated origin as soon as it is available, provided the
alternative service information is fresh (Section 2.2) and the alternative service information is fresh (Section 2.2) and the
security properties of the alternative service protocol are security properties of the alternative service protocol are
desirable, as compared to the existing connection. A viable desirable, as compared to the existing connection. A viable
alternative service is then treated in every way as the origin; this alternative service is then treated in every way as the origin; this
includes the ability to advertise alternative services. includes the ability to advertise alternative services.
If a client becomes aware of multiple alternative services, it If a client becomes aware of multiple alternative services, it
chooses the most suitable according to its own criteria (again, chooses the most suitable according to its own criteria, keeping
keeping security properties in mind). For example, an origin might security properties in mind. For example, an origin might advertise
advertise multiple alternative services to notify clients of support multiple alternative services to notify clients of support for
for multiple versions of HTTP. multiple versions of HTTP.
A client configured to use a proxy for a given request SHOULD NOT A client configured to use a proxy for a given request SHOULD NOT
directly connect to an alternative service for this request, but directly connect to an alternative service for this request, but
instead route it through that proxy. instead route it through that proxy.
When a client uses an alternative service for a request, it can When a client uses an alternative service for a request, it can
indicate this to the server using the Alt-Used header field indicate this to the server using the Alt-Used header field
(Section 5). (Section 5).
The client does not need to block requests on any existing The client does not need to block requests on any existing
connection; it can be used until the alternative connection is connection; it can be used until the alternative connection is
established. However, if the security properties of the existing established. However, if the security properties of the existing
connection are weak (e.g. cleartext HTTP/1.1) then it might make connection are weak (for example, cleartext HTTP/1.1) then it might
sense to block until the new connection is fully available in order make sense to block until the new connection is fully available in
to avoid information leakage. order to avoid information leakage.
Furthermore, if the connection to the alternative service fails or is Furthermore, if the connection to the alternative service fails or is
unresponsive, the client MAY fall back to using the origin or another unresponsive, the client MAY fall back to using the origin or another
alternative service. Note, however, that this could be the basis of alternative service. Note, however, that this could be the basis of
a downgrade attack, thus losing any enhanced security properties of a downgrade attack, thus losing any enhanced security properties of
the alternative service. If the connection to the alternative the alternative service. If the connection to the alternative
service does not negotiate the expected protocol (for example, ALPN service does not negotiate the expected protocol (for example, ALPN
fails to negotiate h2, or an Upgrade request to h2c is not accepted), fails to negotiate h2, or an Upgrade request to h2c is not accepted),
the connection to the alternative service MUST be considered to have the connection to the alternative service MUST be considered to have
failed. failed.
skipping to change at page 10, line 33 skipping to change at page 10, line 37
| ALPN protocol name | protocol-id | Note | | ALPN protocol name | protocol-id | Note |
+--------------------+-------------+---------------------+ +--------------------+-------------+---------------------+
| h2 | h2 | No escaping needed | | h2 | h2 | No escaping needed |
+--------------------+-------------+---------------------+ +--------------------+-------------+---------------------+
| w=x:y#z | w%3Dx%3Ay#z | "=" and ":" escaped | | w=x:y#z | w%3Dx%3Ay#z | "=" and ":" escaped |
+--------------------+-------------+---------------------+ +--------------------+-------------+---------------------+
| x%y | x%25y | "%" needs escaping | | x%y | x%25y | "%" needs escaping |
+--------------------+-------------+---------------------+ +--------------------+-------------+---------------------+
Alt-Svc MAY occur in any HTTP response message, regardless of the Alt-Svc MAY occur in any HTTP response message, regardless of the
status code. Note that recipients of Alt-Svc are free to ignore the status code. Note that recipients of Alt-Svc can ignore the header
header field (and indeed need to in some situations; see Sections 2.1 field (and are required to in some situations; see Sections 2.1 and
and 6). 6).
The Alt-Svc field value can have multiple values: The Alt-Svc field value can have multiple values:
Alt-Svc: h2c=":8000", h2=":443" Alt-Svc: h2="alt.example.com:8000", h2=":443"
When multiple values are present, the order of the values reflects When multiple values are present, the order of the values reflects
the server's preference (with the first value being the most the server's preference (with the first value being the most
preferred alternative). preferred alternative).
The value(s) advertised by Alt-Svc can be used by clients to open a The value(s) advertised by Alt-Svc can be used by clients to open a
new connection to an alternative service. Subsequent requests can new connection to an alternative service. Subsequent requests can
start using this new connection immediately, or can continue using start using this new connection immediately, or can continue using
the existing connection while the new connection is created. the existing connection while the new connection is created.
skipping to change at page 11, line 12 skipping to change at page 11, line 16
frame (Section 4). A single ALTSVC frame can be sent for a frame (Section 4). A single ALTSVC frame can be sent for a
connection; a new frame is not needed for every request. Note that, connection; a new frame is not needed for every request. Note that,
despite this recommendation, Alt-Svc header fields remain valid in despite this recommendation, Alt-Svc header fields remain valid in
responses delivered over HTTP/2. responses delivered over HTTP/2.
Each "alt-value" is followed by an OPTIONAL semicolon-separated list Each "alt-value" is followed by an OPTIONAL semicolon-separated list
of additional parameters, each such "parameter" comprising a name and of additional parameters, each such "parameter" comprising a name and
a value. a value.
This specification defines two parameters: "ma" and "persist", This specification defines two parameters: "ma" and "persist",
defined in Section 3.1. Unknown parameters MUST be ignored, that is defined in Section 3.1. Unknown parameters MUST be ignored. That
the values (alt-value) they appear in MUST be processed as if the is, the values (alt-value) they appear in MUST be processed as if the
unknown parameter was not present. unknown parameter was not present.
New parameters can be defined in extension specifications (see New parameters can be defined in extension specifications (see
Section 7.3 for registration details). Section 7.3 for registration details).
Note that all field elements that allow "quoted-string" syntax MUST Note that all field elements that allow "quoted-string" syntax MUST
be processed as per Section 3.2.6 of [RFC7230]. be processed as per Section 3.2.6 of [RFC7230].
3.1. Caching Alt-Svc Header Field Values 3.1. Caching Alt-Svc Header Field Values
skipping to change at page 11, line 47 skipping to change at page 12, line 11
See Section 4.2.3 of [RFC7234] for details of determining response See Section 4.2.3 of [RFC7234] for details of determining response
age. age.
For example, a response: For example, a response:
HTTP/1.1 200 OK HTTP/1.1 200 OK
Content-Type: text/html Content-Type: text/html
Cache-Control: max-age=600 Cache-Control: max-age=600
Age: 30 Age: 30
Alt-Svc: h2c=":8000"; ma=60 Alt-Svc: h2=":8000"; ma=60
indicates that an alternative service is available and usable for the indicates that an alternative service is available and usable for the
next 60 seconds. However, the response has already been cached for next 60 seconds. However, the response has already been cached for
30 seconds (as per the Age header field value), so therefore the 30 seconds (as per the Age header field value), so therefore the
alternative service is only fresh for the 30 seconds from when this alternative service is only fresh for the 30 seconds from when this
response was received, minus estimated transit time. response was received, minus estimated transit time.
Note that the freshness lifetime for HTTP caching (here, 600 seconds) Note that the freshness lifetime for HTTP caching (here, 600 seconds)
does not affect caching of Alt-Svc values. does not affect caching of Alt-Svc values.
When an Alt-Svc response header field is received from an origin, its When an Alt-Svc response header field is received from an origin, its
value invalidates and replaces all cached alternative services for value invalidates and replaces all cached alternative services for
that origin. that origin.
By default, cached alternative services will be cleared when the By default, cached alternative services will be cleared when the
client detects a network change. Alternative services that are client detects a network change. Alternative services that are
intended to be longer-lived (e.g., those that are not specific to the intended to be longer-lived (such as those that are not specific to
client access network) can carry the "persist" parameter with a value the client access network) can carry the "persist" parameter with a
"1" as a hint that the service is potentially useful beyond a network value "1" as a hint that the service is potentially useful beyond a
configuration change. network configuration change.
Syntax: Syntax:
persist = "1" persist = "1"
For example: For example:
Alt-Svc: h2=":443"; ma=2592000; persist=1 Alt-Svc: h2=":443"; ma=2592000; persist=1
This specification only defines a single value for "persist". This specification only defines a single value for "persist".
skipping to change at page 12, line 41 skipping to change at page 13, line 4
See Section 2.2 for general requirements on caching alternative See Section 2.2 for general requirements on caching alternative
services. services.
4. The ALTSVC HTTP/2 Frame 4. The ALTSVC HTTP/2 Frame
The ALTSVC HTTP/2 frame ([RFC7540], Section 4) advertises the The ALTSVC HTTP/2 frame ([RFC7540], Section 4) advertises the
availability of an alternative service to an HTTP/2 client. availability of an alternative service to an HTTP/2 client.
The ALTSVC frame is a non-critical extension to HTTP/2. Endpoints The ALTSVC frame is a non-critical extension to HTTP/2. Endpoints
that do not support this frame can safely ignore it. that do not support this frame will ignore it (as per the
extensibility rules defined in Section 4.1 of [RFC7540]).
An ALTSVC frame from a server to a client on a stream other than An ALTSVC frame from a server to a client on a stream other than
stream 0 indicates that the conveyed alternative service is stream 0 indicates that the conveyed alternative service is
associated with the origin of that stream. associated with the origin of that stream.
An ALTSVC frame from a server to a client on stream 0 indicates that An ALTSVC frame from a server to a client on stream 0 indicates that
the conveyed alternative service is associated with the origin the conveyed alternative service is associated with the origin
contained in the Origin field of the frame. An association with an contained in the Origin field of the frame. An association with an
origin that the client does not consider authoritative for the origin that the client does not consider authoritative for the
current connection MUST be ignored. current connection MUST be ignored.
skipping to change at page 13, line 31 skipping to change at page 13, line 43
serialization of an origin ([RFC6454], Section 6.2) that the serialization of an origin ([RFC6454], Section 6.2) that the
alternative service is applicable to. alternative service is applicable to.
Alt-Svc-Field-Value: A sequence of octets (length determined by Alt-Svc-Field-Value: A sequence of octets (length determined by
subtracting the length of all preceding fields from the frame subtracting the length of all preceding fields from the frame
length) containing a value identical to the Alt-Svc field value length) containing a value identical to the Alt-Svc field value
defined in Section 3 (ABNF production "Alt-Svc"). defined in Section 3 (ABNF production "Alt-Svc").
The ALTSVC frame does not define any flags. The ALTSVC frame does not define any flags.
The ALTSVC frame is intended for receipt by clients; a server that The ALTSVC frame is intended for receipt by clients. A device acting
receives an ALTSVC frame can safely ignore it. as a server MUST ignore it.
An ALTSVC frame on stream 0 with empty (length 0) "Origin" An ALTSVC frame on stream 0 with empty (length 0) "Origin"
information is invalid and MUST be ignored. An ALTSVC frame on a information is invalid and MUST be ignored. An ALTSVC frame on a
stream other than stream 0 containing non-empty "Origin" information stream other than stream 0 containing non-empty "Origin" information
is invalid and MUST be ignored. is invalid and MUST be ignored.
The ALTSVC frame is processed hop-by-hop. An intermediary MUST NOT The ALTSVC frame is processed hop-by-hop. An intermediary MUST NOT
forward ALTSVC frames, though it can use the information contained in forward ALTSVC frames, though it can use the information contained in
ALTSVC frames in forming new ALTSVC frames to send to its own ALTSVC frames in forming new ALTSVC frames to send to its own
clients. clients.
skipping to change at page 17, line 7 skipping to change at page 17, line 20
For example, if an attacker can convince a user agent to send all For example, if an attacker can convince a user agent to send all
traffic for "innocent.example.org" to "evil.example.com" by traffic for "innocent.example.org" to "evil.example.com" by
successfully associating it as an alternative service, they can successfully associating it as an alternative service, they can
masquerade as that origin. This can be done locally (see mitigations masquerade as that origin. This can be done locally (see mitigations
in Section 9.1) or remotely (e.g., by an intermediary as a man-in- in Section 9.1) or remotely (e.g., by an intermediary as a man-in-
the-middle attack). the-middle attack).
This is the reason for the requirement in Section 2.1 that clients This is the reason for the requirement in Section 2.1 that clients
have reasonable assurances that the alternative service is under have reasonable assurances that the alternative service is under
control of and valid for the whole origin; i.e., presenting a control of and valid for the whole origin; presenting a certificate
certificate for the origin proves that the alternative service is for the origin proves that the alternative service is authorized to
authorized to serve traffic for the origin. serve traffic for the origin.
Note that this assurance is only as strong as the method used to Note that this assurance is only as strong as the method used to
authenticate the alternative service. In particular, when TLS authenticate the alternative service. In particular, when TLS
authentication is used to do so, there are well-known exploits to authentication is used to do so, there are well-known exploits to
make an attacker's certificate appear as legitimate. make an attacker's certificate appear as legitimate.
Alternative services could be used to persist such an attack; for Alternative services could be used to persist such an attack. For
example, an intermediary could man-in-the-middle TLS-protected example, an intermediary could man-in-the-middle TLS-protected
communication to a target, and then direct all traffic to an communication to a target, and then direct all traffic to an
alternative service with a large freshness lifetime, so that the user alternative service with a large freshness lifetime, so that the user
agent still directs traffic to the attacker even when not using the agent still directs traffic to the attacker even when not using the
intermediary. intermediary.
Implementations MUST perform any certificate-pinning validation (e.g. Implementations MUST perform any certificate-pinning validation (such
[RFC7469]) on alternative services just as they would on direct as [RFC7469]) on alternative services just as they would on direct
connections to the origin. Implementations might also choose to add connections to the origin. Implementations might also choose to add
other requirements around which certificates are acceptable for other requirements around which certificates are acceptable for
alternative services. alternative services.
9.3. Changing Protocols 9.3. Changing Protocols
When the ALPN protocol is changed due to the use of an alternative When the ALPN protocol is changed due to the use of an alternative
service, the security properties of the new connection to the origin service, the security properties of the new connection to the origin
can be different from that of the "normal" connection to the origin, can be different from that of the "normal" connection to the origin,
because the protocol identifier itself implies this. because the protocol identifier itself implies this.
skipping to change at page 17, line 39 skipping to change at page 17, line 52
9.3. Changing Protocols 9.3. Changing Protocols
When the ALPN protocol is changed due to the use of an alternative When the ALPN protocol is changed due to the use of an alternative
service, the security properties of the new connection to the origin service, the security properties of the new connection to the origin
can be different from that of the "normal" connection to the origin, can be different from that of the "normal" connection to the origin,
because the protocol identifier itself implies this. because the protocol identifier itself implies this.
For example, if an "https://" URI has a protocol advertised that does For example, if an "https://" URI has a protocol advertised that does
not use some form of end-to-end encryption (most likely, TLS), it not use some form of end-to-end encryption (most likely, TLS), it
violates the expectations for security that the URI scheme implies. violates the expectations for security that the URI scheme implies.
Therefore, clients cannot blindly use alternative services, but Therefore, clients cannot blindly use alternative services, but
instead evaluate the option(s) presented to assure that security instead evaluate the option(s) presented to assure that security
requirements and expectations (of specifications, implementations and requirements and expectations of specifications, implementations and
end users) are met. end users are met.
9.4. Tracking Clients Using Alternative Services 9.4. Tracking Clients Using Alternative Services
Choosing an alternative service implies connecting to a new, server- Choosing an alternative service implies connecting to a new, server-
supplied host name. By using many different (potentially unique) supplied host name. By using unique names, servers could conceivably
host names, servers could conceivably track client requests. Such track client requests. Such tracking could follow users across
tracking could follow users across multiple networks, when the multiple networks, when the "persist" flag is used.
"persist" flag is used.
Clients that wish to prevent requests from being correlated (such as Clients that wish to prevent requests from being correlated can
those that offer modes aimed at providing improved privacy) can
decide not to use alternative services for multiple requests that decide not to use alternative services for multiple requests that
would not otherwise be allowed to be correlated. would not otherwise be allowed to be correlated.
In a user agent, any alternative service information MUST be removed In a user agent, any alternative service information MUST be removed
when origin-specific data is cleared (for instance, when cookies are when origin-specific data is cleared (typically, when cookies
cleared). [RFC6265] are cleared).
9.5. Confusion Regarding Request Scheme 9.5. Confusion Regarding Request Scheme
Some server-side HTTP applications make assumptions about security Some server-side HTTP applications make assumptions about security
based upon connection context; for example, equating being served based upon connection context; for example, equating being served
upon port 443 with the use of an "https://" URI (and the various upon port 443 with the use of an "https://" URI and the various
security properties that implies). security properties that implies.
This affects not only the security properties of the connection This affects not only the security properties of the connection
itself, but also the state of the client at the other end of it; for itself, but also the state of the client at the other end of it; for
example, a Web browser treats "https://" URIs differently than example, a Web browser treats "https://" URIs differently than
"http://" URIs in many ways, not just for purposes of protocol "http://" URIs in many ways, not just for purposes of protocol
handling. handling.
Since one of the uses of Alternative Services is to allow a Since one of the uses of Alternative Services is to allow a
connection to be migrated to a different protocol and port, these connection to be migrated to a different protocol and port, these
applications can become confused about the security properties of a applications can become confused about the security properties of a
given connection, sending information (e.g., cookies, content) that given connection, sending information (for example, cookies and
is intended for a secure context (e.g., an "https://" URI) to a content) that is intended for a secure context (such as an "https://"
client that is not treating it as one. URI) to a client that is not treating it as one.
This risk can be mitigated in servers by using the URI scheme This risk can be mitigated in servers by using the URI scheme
explicitly carried by the protocol (e.g., ":scheme" in HTTP/2 or the explicitly carried by the protocol (such as ":scheme" in HTTP/2 or
"absolute form" of the request target in HTTP/1.1) as an indication the "absolute form" of the request target in HTTP/1.1) as an
of security context, instead of other connection properties indication of security context, instead of other connection
([RFC7540], Section 8.1.2.3 and [RFC7230], Section 5.3.2). properties ([RFC7540], Section 8.1.2.3 and [RFC7230], Section 5.3.2).
When the protocol does not explicitly carry the scheme (e.g., as is When the protocol does not explicitly carry the scheme (as is usually
usually the case for HTTP/1.1 over TLS, servers can mitigate this the case for HTTP/1.1 over TLS), servers can mitigate this risk by
risk by either assuming that all requests have an insecure context, either assuming that all requests have an insecure context, or by
or by refraining from advertising alternative services for insecure refraining from advertising alternative services for insecure
schemes (such as HTTP). schemes, for example HTTP.
10. References 10. References
10.1. Normative References 10.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/ Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/
RFC2119, March 1997, RFC2119, March 1997,
<http://www.rfc-editor.org/info/rfc2119>. <http://www.rfc-editor.org/info/rfc2119>.
[RFC2818] Rescorla, E., "HTTP Over TLS", RFC 2818, DOI 10.17487/
RFC2818, May 2000,
<http://www.rfc-editor.org/info/rfc2818>.
[RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform [RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform
Resource Identifier (URI): Generic Syntax", STD 66, Resource Identifier (URI): Generic Syntax", STD 66,
RFC 3986, DOI 10.17487/RFC3986, January 2005, RFC 3986, DOI 10.17487/RFC3986, January 2005,
<http://www.rfc-editor.org/info/rfc3986>. <http://www.rfc-editor.org/info/rfc3986>.
[RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an [RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an
IANA Considerations Section in RFCs", BCP 26, RFC 5226, IANA Considerations Section in RFCs", BCP 26, RFC 5226,
DOI 10.17487/RFC5226, May 2008, DOI 10.17487/RFC5226, May 2008,
<http://www.rfc-editor.org/info/rfc5226>. <http://www.rfc-editor.org/info/rfc5226>.
skipping to change at page 20, line 21 skipping to change at page 20, line 35
[BCP90] Klyne, G., Nottingham, M., and J. Mogul, "Registration [BCP90] Klyne, G., Nottingham, M., and J. Mogul, "Registration
Procedures for Message Header Fields", BCP 90, RFC 3864, Procedures for Message Header Fields", BCP 90, RFC 3864,
September 2004, <http://www.rfc-editor.org/info/bcp90>. September 2004, <http://www.rfc-editor.org/info/bcp90>.
[RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security [RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security
(TLS) Protocol Version 1.2", RFC 5246, DOI 10.17487/ (TLS) Protocol Version 1.2", RFC 5246, DOI 10.17487/
RFC5246, August 2008, RFC5246, August 2008,
<http://www.rfc-editor.org/info/rfc5246>. <http://www.rfc-editor.org/info/rfc5246>.
[RFC6265] Barth, A., "HTTP State Management Mechanism", RFC 6265,
DOI 10.17487/RFC6265, April 2011,
<http://www.rfc-editor.org/info/rfc6265>.
[RFC7469] Evans, C., Palmer, C., and R. Sleevi, "Public Key Pinning [RFC7469] Evans, C., Palmer, C., and R. Sleevi, "Public Key Pinning
Extension for HTTP", RFC 7469, DOI 10.17487/RFC7469, Extension for HTTP", RFC 7469, DOI 10.17487/RFC7469,
April 2015, <http://www.rfc-editor.org/info/rfc7469>. April 2015, <http://www.rfc-editor.org/info/rfc7469>.
Appendix A. Change Log (to be removed by RFC Editor before publication) Appendix A. Change Log (to be removed by RFC Editor before publication)
A.1. Since draft-nottingham-httpbis-alt-svc-05 A.1. Since draft-nottingham-httpbis-alt-svc-05
This is the first version after adoption of This is the first version after adoption of
draft-nottingham-httpbis-alt-svc-05 as Working Group work item. It draft-nottingham-httpbis-alt-svc-05 as Working Group work item. It
skipping to change at page 24, line 18 skipping to change at page 24, line 36
(<https://github.com/httpwg/http-extensions/issues/130>). (<https://github.com/httpwg/http-extensions/issues/130>).
Use RFC 7405 ABNF extension Use RFC 7405 ABNF extension
(<https://github.com/httpwg/http-extensions/issues/131>). (<https://github.com/httpwg/http-extensions/issues/131>).
A.13. Since draft-ietf-httpbis-alt-svc-11 A.13. Since draft-ietf-httpbis-alt-svc-11
Security considerations wrt system ports Security considerations wrt system ports
(<https://github.com/httpwg/http-extensions/issues/139>). (<https://github.com/httpwg/http-extensions/issues/139>).
A.14. Since draft-ietf-httpbis-alt-svc-12
Editorial changes triggered by <https://lists.w3.org/Archives/Public/
ietf-http-wg/2016JanMar/0243.html>.
Reasonable Assurances and H2C
(<https://github.com/httpwg/http-extensions/issues/148>).
Appendix B. Acknowledgements Appendix B. Acknowledgements
Thanks to Adam Langley, Bence Beky, Eliot Lear, Erik Nygren, Guy Thanks to Adam Langley, Bence Beky, Chris Lonvick, Eliot Lear, Erik
Podjarny, Herve Ruellan, Lucas Pardue, Martin Thomson, Matthew Nygren, Guy Podjarny, Herve Ruellan, Lucas Pardue, Martin Thomson,
Kerwin, Mike Bishop, Paul Hoffman, Richard Barnes, Richard Bradbury, Matthew Kerwin, Mike Bishop, Paul Hoffman, Richard Barnes, Richard
Stephen Farrell, Stephen Ludin, and Will Chan for their feedback and Bradbury, Stephen Farrell, Stephen Ludin, and Will Chan for their
suggestions. feedback and suggestions.
The Alt-Svc header field was influenced by the design of the The Alt-Svc header field was influenced by the design of the
Alternate-Protocol header field in SPDY. Alternate-Protocol header field in SPDY.
Authors' Addresses Authors' Addresses
Mark Nottingham Mark Nottingham
Akamai Akamai
EMail: mnot@mnot.net EMail: mnot@mnot.net
 End of changes. 51 change blocks. 
102 lines changed or deleted 119 lines changed or added

This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/