| < draft-nottingham-rfc5785bis-00.txt | draft-nottingham-rfc5785bis-01.txt > | |||
|---|---|---|---|---|
| Network Working Group M. Nottingham | Network Working Group M. Nottingham | |||
| Internet-Draft November 13, 2017 | Internet-Draft November 13, 2017 | |||
| Obsoletes: 5785 (if approved) | Obsoletes: 5785 (if approved) | |||
| Intended status: Standards Track | Intended status: Standards Track | |||
| Expires: May 17, 2018 | Expires: May 17, 2018 | |||
| Defining Well-Known Uniform Resource Identifiers (URIs) | Defining Well-Known Uniform Resource Identifiers (URIs) | |||
| draft-nottingham-rfc5785bis-00 | draft-nottingham-rfc5785bis-01 | |||
| Abstract | Abstract | |||
| This memo defines a path prefix for "well-known locations", "/.well- | This memo defines a path prefix for "well-known locations", "/.well- | |||
| known/", in selected Uniform Resource Identifier (URI) schemes. | known/", in selected Uniform Resource Identifier (URI) schemes. | |||
| Note to Readers | Note to Readers | |||
| _RFC EDITOR: please remove this section before publication_ | _RFC EDITOR: please remove this section before publication_ | |||
| This draft is a proposed revision of RFC5875. Version -00 is a copy | This draft is a proposed revision of RFC5875. | |||
| of the original RFC. | ||||
| The issues list for this draft can be found at | The issues list for this draft can be found at | |||
| https://github.com/mnot/I-D/labels/5785bis . | https://github.com/mnot/I-D/labels/5785bis . | |||
| The most recent (often, unpublished) draft is at | The most recent (often, unpublished) draft is at | |||
| https://mnot.github.io/I-D/5785bis/ . | https://mnot.github.io/I-D/5785bis/ . | |||
| Recent changes are listed at https://github.com/mnot/I-D/commits/gh- | Recent changes are listed at https://github.com/mnot/I-D/commits/gh- | |||
| pages/5785bis . | pages/5785bis . | |||
| skipping to change at page 2, line 26 ¶ | skipping to change at page 2, line 26 ¶ | |||
| to this document. Code Components extracted from this document must | to this document. Code Components extracted from this document must | |||
| include Simplified BSD License text as described in Section 4.e of | include Simplified BSD License text as described in Section 4.e of | |||
| the Trust Legal Provisions and are provided without warranty as | the Trust Legal Provisions and are provided without warranty as | |||
| described in the Simplified BSD License. | described in the Simplified BSD License. | |||
| Table of Contents | Table of Contents | |||
| 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 | 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 | |||
| 1.1. Appropriate Use of Well-Known URIs . . . . . . . . . . . 3 | 1.1. Appropriate Use of Well-Known URIs . . . . . . . . . . . 3 | |||
| 2. Notational Conventions . . . . . . . . . . . . . . . . . . . 3 | 2. Notational Conventions . . . . . . . . . . . . . . . . . . . 3 | |||
| 3. Well-Known URIs . . . . . . . . . . . . . . . . . . . . . . . 3 | 3. Well-Known URIs . . . . . . . . . . . . . . . . . . . . . . . 4 | |||
| 4. Security Considerations . . . . . . . . . . . . . . . . . . . 4 | 4. Security Considerations . . . . . . . . . . . . . . . . . . . 4 | |||
| 5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 4 | 5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 5 | |||
| 5.1. The Well-Known URI Registry . . . . . . . . . . . . . . . 4 | 5.1. The Well-Known URI Registry . . . . . . . . . . . . . . . 5 | |||
| 5.1.1. Registration Template . . . . . . . . . . . . . . . . 5 | 5.1.1. Registration Template . . . . . . . . . . . . . . . . 5 | |||
| 6. References . . . . . . . . . . . . . . . . . . . . . . . . . 5 | 6. References . . . . . . . . . . . . . . . . . . . . . . . . . 5 | |||
| 6.1. Normative References . . . . . . . . . . . . . . . . . . 5 | 6.1. Normative References . . . . . . . . . . . . . . . . . . 5 | |||
| 6.2. Informative References . . . . . . . . . . . . . . . . . 6 | 6.2. Informative References . . . . . . . . . . . . . . . . . 6 | |||
| Appendix A. Acknowledgements . . . . . . . . . . . . . . . . . . 6 | Appendix A. Frequently Asked Questions . . . . . . . . . . . . . 6 | |||
| Appendix B. Frequently Asked Questions . . . . . . . . . . . . . 6 | Appendix B. Changes from RFC5785 . . . . . . . . . . . . . . . . 7 | |||
| Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 7 | Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 7 | |||
| 1. Introduction | 1. Introduction | |||
| It is increasingly common for Web-based protocols to require the | Some applications on the Web require the discovery of policy or other | |||
| discovery of policy or other information about a host ("site-wide | information about an origin [RFC6454] (sometimes called "site-wide | |||
| metadata") before making a request. For example, the Robots | metadata") before making a request. For example, the Robots | |||
| Exclusion Protocol (http://www.robotstxt.org/ ) specifies a way for | Exclusion Protocol (http://www.robotstxt.org/ ) specifies a way for | |||
| automated processes to obtain permission to access resources; | automated processes to obtain permission to access resources; | |||
| likewise, the Platform for Privacy Preferences [W3C.REC-P3P-20020416] | likewise, the Platform for Privacy Preferences [W3C.REC-P3P-20020416] | |||
| tells user-agents how to discover privacy policy beforehand. | tells user-agents how to discover privacy policy before interacting | |||
| with a site. | ||||
| While there are several ways to access per-resource metadata (e.g., | While there are several ways to access per-resource metadata (e.g., | |||
| HTTP headers, WebDAV's PROPFIND [RFC4918]), the perceived overhead | HTTP headers, WebDAV's PROPFIND [RFC4918]), the perceived overhead | |||
| (either in terms of client-perceived latency and/or deployment | (either in terms of client-perceived latency and/or deployment | |||
| difficulties) associated with them often precludes their use in these | difficulties) associated with them often precludes their use in these | |||
| scenarios. | scenarios. | |||
| When this happens, it is common to designate a "well-known location" | When this happens, one solution is designating a "well-known | |||
| for such data, so that it can be easily located. However, this | location" for data or services related to the origin, so that it can | |||
| approach has the drawback of risking collisions, both with other such | be easily located. However, this approach has the drawback of | |||
| designated "well-known locations" and with pre-existing resources. | risking collisions, both with other such designated "well-known | |||
| locations" and with pre-existing resources. | ||||
| To address this, this memo defines a path prefix in HTTP(S) URIs for | To address this, this memo defines a path prefix in HTTP(S) URIs for | |||
| these "well-known locations", "/.well-known/". Future specifications | these "well-known locations", "/.well-known/". Future specifications | |||
| that need to define a resource for such site-wide metadata can | that need to define a resource for such site-wide metadata can | |||
| register their use to avoid collisions and minimise impingement upon | register their use to avoid collisions and minimise impingement upon | |||
| sites' URI space. | sites' URI space. | |||
| Well-known URIs can also be used with other URI schemes, but only | ||||
| when those schemes' definitions explicitly allow it. | ||||
| 1.1. Appropriate Use of Well-Known URIs | 1.1. Appropriate Use of Well-Known URIs | |||
| There are a number of possible ways that applications could use Well- | There are a number of possible ways that applications could use well- | |||
| known URIs. However, in keeping with the Architecture of the World- | known URIs. However, in keeping with the Architecture of the World- | |||
| Wide Web [W3C.REC-webarch-20041215], well-known URIs are not intended | Wide Web [W3C.REC-webarch-20041215], well-known URIs are not intended | |||
| for general information retrieval or establishment of large URI | for general information retrieval or establishment of large URI | |||
| namespaces on the Web. Rather, they are designed to facilitate | namespaces on the Web. Rather, they are designed to facilitate | |||
| discovery of information on a site when it isn't practical to use | discovery of information on a site when it isn't practical to use | |||
| other mechanisms; for example, when discovering policy that needs to | other mechanisms; for example, when discovering policy that needs to | |||
| be evaluated before a resource is accessed, or when using multiple | be evaluated before a resource is accessed, or when using multiple | |||
| round-trips is judged detrimental to performance. | round-trips is judged detrimental to performance. | |||
| As such, the well-known URI space was created with the expectation | As such, the well-known URI space was created with the expectation | |||
| that it will be used to make site-wide policy information and other | that it will be used to make policy information and other metadata | |||
| metadata available directly (if sufficiently concise), or provide | about the origin available directly (if sufficiently concise), or | |||
| references to other URIs that provide such metadata. | provide references to other URIs that provide it. | |||
| Therefore, it is inappropriate to use well-known URIs as a means of | ||||
| identifying or locating a new protocol built on top of HTTP, since | ||||
| they are intended for metadata about their origin. | ||||
| In particular, locating information using a hostname instead of a URI | ||||
| is, on its own, insufficient reason to register a well-known URI. | ||||
| 2. Notational Conventions | 2. Notational Conventions | |||
| The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", | The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", | |||
| "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this | "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this | |||
| document are to be interpreted as described in RFC 2119 [RFC2119]. | document are to be interpreted as described in RFC 2119 [RFC2119]. | |||
| 3. Well-Known URIs | 3. Well-Known URIs | |||
| A well-known URI is a URI [RFC3986] whose path component begins with | A well-known URI is a URI [RFC3986] whose path component begins with | |||
| skipping to change at page 4, line 10 ¶ | skipping to change at page 4, line 20 ¶ | |||
| known URIs. | known URIs. | |||
| Applications that wish to mint new well-known URIs MUST register | Applications that wish to mint new well-known URIs MUST register | |||
| them, following the procedures in Section 5.1. | them, following the procedures in Section 5.1. | |||
| For example, if an application registers the name 'example', the | For example, if an application registers the name 'example', the | |||
| corresponding well-known URI on 'http://www.example.com/' would be | corresponding well-known URI on 'http://www.example.com/' would be | |||
| 'http://www.example.com/.well-known/example'. | 'http://www.example.com/.well-known/example'. | |||
| Registered names MUST conform to the segment-nz production in | Registered names MUST conform to the segment-nz production in | |||
| [RFC3986]. | [RFC3986]. This means they cannot contain the "/" character. | |||
| Note that this specification defines neither how to determine the | Note that this specification defines neither how to determine the | |||
| authority to use for a particular context, nor the scope of the | authority to use for a particular context, nor the scope of the | |||
| metadata discovered by dereferencing the well-known URI; both should | metadata discovered by dereferencing the well-known URI; both should | |||
| be defined by the application itself. | be defined by the application itself. | |||
| Typically, a registration will reference a specification that defines | Typically, a registration will reference a specification that defines | |||
| the format and associated media type to be obtained by dereferencing | the format and associated media type to be obtained by dereferencing | |||
| the well-known URI. | the well-known URI. | |||
| It MAY also contain additional information, such as the syntax of | It MAY also contain additional information, such as the syntax of | |||
| additional path components, query strings and/or fragment identifiers | additional path components, query strings and/or fragment identifiers | |||
| to be appended to the well-known URI, or protocol-specific details | to be appended to the well-known URI, or protocol-specific details | |||
| (e.g., HTTP [RFC2616] method handling). | (e.g., HTTP [RFC7231] method handling). | |||
| Note that this specification does not define a format or media-type | Note that this specification does not define a format or media-type | |||
| for the resource located at "/.well-known/" and clients should not | for the resource located at "/.well-known/" and clients should not | |||
| expect a resource to exist at that location. | expect a resource to exist at that location. | |||
| 4. Security Considerations | 4. Security Considerations | |||
| This memo does not specify the scope of applicability of metadata or | This memo does not specify the scope of applicability of metadata or | |||
| policy obtained from a well-known URI, and does not specify how to | policy obtained from a well-known URI, and does not specify how to | |||
| discover a well-known URI for a particular application. Individual | discover a well-known URI for a particular application. Individual | |||
| skipping to change at page 4, line 49 ¶ | skipping to change at page 5, line 11 ¶ | |||
| issues, including (but not limited to) exposure of sensitive data, | issues, including (but not limited to) exposure of sensitive data, | |||
| denial-of-service attacks (in addition to normal load issues), server | denial-of-service attacks (in addition to normal load issues), server | |||
| and client authentication, vulnerability to DNS rebinding attacks, | and client authentication, vulnerability to DNS rebinding attacks, | |||
| and attacks where limited access to a server grants the ability to | and attacks where limited access to a server grants the ability to | |||
| affect how well-known URIs are served. | affect how well-known URIs are served. | |||
| 5. IANA Considerations | 5. IANA Considerations | |||
| 5.1. The Well-Known URI Registry | 5.1. The Well-Known URI Registry | |||
| This document establishes the well-known URI registry. | This document specifies procedures for the well-known URI registry, | |||
| first defined in [RFC5785]. | ||||
| Well-known URIs are registered on the advice of one or more | Well-known URIs are registered on the advice of one or more experts | |||
| Designated Experts (appointed by the IESG or their delegate), with a | (appointed by the IESG or their delegate), with a Specification | |||
| Specification Required (using terminology from [RFC5226]). However, | Required (using terminology from [RFC8126]). However, to allow for | |||
| to allow for the allocation of values prior to publication, the | the allocation of values prior to publication, the expert(s) may | |||
| Designated Expert(s) may approve registration once they are satisfied | approve registration once they are satisfied that such a | |||
| that such a specification will be published. | specification will be published. | |||
| Registration requests should be sent to the wellknown-uri- | Registration requests can be sent to the wellknown-uri- | |||
| review@ietf.org mailing list for review and comment, with an | review@ietf.org mailing list for review and comment, with an | |||
| appropriate subject (e.g., "Request for well-known URI: example"). | appropriate subject (e.g., "Request for well-known URI: example"). | |||
| Before a period of 14 days has passed, the Designated Expert(s) will | ||||
| either approve or deny the registration request, communicating this | ||||
| decision both to the review list and to IANA. Denials should include | ||||
| an explanation and, if applicable, suggestions as to how to make the | ||||
| request successful. Registration requests that are undetermined for | ||||
| a period longer than 21 days can be brought to the IESG's attention | ||||
| (using the iesg@iesg.org mailing list) for resolution. | ||||
| 5.1.1. Registration Template | 5.1.1. Registration Template | |||
| URI suffix: The name requested for the well-known URI, relative to | URI suffix: The name requested for the well-known URI, relative to | |||
| "/.well-known/"; e.g., "example". | "/.well-known/"; e.g., "example". | |||
| Change controller: For Standards-Track RFCs, state "IETF". For | Change controller: For Standards-Track RFCs, state "IETF". For | |||
| others, give the name of the responsible party. Other details | others, give the name of the responsible party. Other details | |||
| (e.g., postal address, e-mail address, home page URI) may also be | (e.g., postal address, e-mail address, home page URI) may also be | |||
| included. | included. | |||
| skipping to change at page 6, line 10 ¶ | skipping to change at page 6, line 10 ¶ | |||
| [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate | [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate | |||
| Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/ | Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/ | |||
| RFC2119, March 1997, <https://www.rfc-editor.org/info/ | RFC2119, March 1997, <https://www.rfc-editor.org/info/ | |||
| rfc2119>. | rfc2119>. | |||
| [RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform | [RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform | |||
| Resource Identifier (URI): Generic Syntax", STD 66, RFC | Resource Identifier (URI): Generic Syntax", STD 66, RFC | |||
| 3986, DOI 10.17487/RFC3986, January 2005, | 3986, DOI 10.17487/RFC3986, January 2005, | |||
| <https://www.rfc-editor.org/info/rfc3986>. | <https://www.rfc-editor.org/info/rfc3986>. | |||
| [RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an | [RFC6454] Barth, A., "The Web Origin Concept", RFC 6454, DOI | |||
| IANA Considerations Section in RFCs", RFC 5226, DOI | 10.17487/RFC6454, December 2011, <https://www.rfc- | |||
| 10.17487/RFC5226, May 2008, <https://www.rfc- | editor.org/info/rfc6454>. | |||
| editor.org/info/rfc5226>. | ||||
| 6.2. Informative References | [RFC8126] Cotton, M., Leiba, B., and T. Narten, "Guidelines for | |||
| Writing an IANA Considerations Section in RFCs", BCP 26, | ||||
| RFC 8126, DOI 10.17487/RFC8126, June 2017, | ||||
| <https://www.rfc-editor.org/info/rfc8126>. | ||||
| [RFC2616] Fielding, R., Gettys, J., Mogul, J., Frystyk, H., | 6.2. Informative References | |||
| Masinter, L., Leach, P., and T. Berners-Lee, "Hypertext | ||||
| Transfer Protocol -- HTTP/1.1", RFC 2616, DOI 10.17487/ | ||||
| RFC2616, June 1999, <https://www.rfc-editor.org/info/ | ||||
| rfc2616>. | ||||
| [RFC4918] Dusseault, L., Ed., "HTTP Extensions for Web Distributed | [RFC4918] Dusseault, L., Ed., "HTTP Extensions for Web Distributed | |||
| Authoring and Versioning (WebDAV)", RFC 4918, DOI | Authoring and Versioning (WebDAV)", RFC 4918, DOI | |||
| 10.17487/RFC4918, June 2007, <https://www.rfc- | 10.17487/RFC4918, June 2007, <https://www.rfc- | |||
| editor.org/info/rfc4918>. | editor.org/info/rfc4918>. | |||
| [RFC5785] Nottingham, M. and E. Hammer-Lahav, "Defining Well-Known | ||||
| Uniform Resource Identifiers (URIs)", RFC 5785, DOI | ||||
| 10.17487/RFC5785, April 2010, <https://www.rfc- | ||||
| editor.org/info/rfc5785>. | ||||
| [RFC7231] Fielding, R., Ed. and J. Reschke, Ed., "Hypertext Transfer | ||||
| Protocol (HTTP/1.1): Semantics and Content", RFC 7231, DOI | ||||
| 10.17487/RFC7231, June 2014, <https://www.rfc- | ||||
| editor.org/info/rfc7231>. | ||||
| [W3C.REC-P3P-20020416] | [W3C.REC-P3P-20020416] | |||
| Marchiori, M., "The Platform for Privacy Preferences 1.0 | Marchiori, M., "The Platform for Privacy Preferences 1.0 | |||
| (P3P1.0) Specification", World Wide Web Consortium | (P3P1.0) Specification", World Wide Web Consortium | |||
| Recommendation REC-P3P-20020416, April 2002, | Recommendation REC-P3P-20020416, April 2002, | |||
| <http://www.w3.org/TR/2002/REC-P3P-20020416>. | <http://www.w3.org/TR/2002/REC-P3P-20020416>. | |||
| Appendix A. Acknowledgements | Appendix A. Frequently Asked Questions | |||
| We would like to acknowledge the contributions of everyone who | ||||
| provided feedback and use cases for this document; in particular, | ||||
| Phil Archer, Dirk Balfanz, Adam Barth, Tim Bray, Brian Eaton, Brad | ||||
| Fitzpatrick, Joe Gregorio, Paul Hoffman, Barry Leiba, Ashok Malhotra, | ||||
| Breno de Medeiros, John Panzer, and Drummond Reed. However, they are | ||||
| not responsible for errors and omissions. | ||||
| Appendix B. Frequently Asked Questions | ||||
| 1. Aren't well-known locations bad for the Web? | 1. Aren't well-known locations bad for the Web? | |||
| They are, but for various reasons - both technical and social - | They are, but for various reasons - both technical and social - | |||
| they are commonly used and their use is increasing. This memo | they are sometimes necessary. This memo defines a "sandbox" for | |||
| defines a "sandbox" for them, to reduce the risks of collision | them, to reduce the risks of collision and to minimise the impact | |||
| and to minimise the impact upon pre-existing URIs on sites. | upon pre-existing URIs on sites. | |||
| 2. Why /.well-known? | 2. Why /.well-known? | |||
| It's short, descriptive, and according to search indices, not | It's short, descriptive, and according to search indices, not | |||
| widely used. | widely used. | |||
| 3. What impact does this have on existing mechanisms, such as P3P | 3. What impact does this have on existing mechanisms, such as P3P | |||
| and robots.txt? | and robots.txt? | |||
| None, until they choose to use this mechanism. | None, until they choose to use this mechanism. | |||
| 4. Why aren't per-directory well-known locations defined? | 4. Why aren't per-directory well-known locations defined? | |||
| Allowing every URI path segment to have a well-known location | Allowing every URI path segment to have a well-known location | |||
| (e.g., "/images/.well-known/") would increase the risks of | (e.g., "/images/.well-known/") would increase the risks of | |||
| colliding with a pre-existing URI on a site, and generally these | colliding with a pre-existing URI on a site, and generally these | |||
| solutions are found not to scale well, because they're too | solutions are found not to scale well, because they're too | |||
| "chatty". | "chatty". | |||
| Appendix B. Changes from RFC5785 | ||||
| o Discuss inappropriate uses more fully | ||||
| o Adjusted IANA instructions | ||||
| o Updated references | ||||
| o Various other clarifications | ||||
| Author's Address | Author's Address | |||
| Mark Nottingham | Mark Nottingham | |||
| Email: mnot@mnot.net | Email: mnot@mnot.net | |||
| URI: https://www.mnot.net/ | URI: https://www.mnot.net/ | |||
| End of changes. 24 change blocks. | ||||
| 61 lines changed or deleted | 73 lines changed or added | |||
This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/ | ||||