idnits 2.17.1 draft-ietf-httpbis-alt-svc-03.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (September 30, 2014) is 3496 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) == Outdated reference: A later version (-17) exists of draft-ietf-httpbis-http2-14 ** Obsolete normative reference: RFC 7230 (Obsoleted by RFC 9110, RFC 9112) ** Obsolete normative reference: RFC 7234 (Obsoleted by RFC 9111) -- Obsolete informational reference (is this intentional?): RFC 5246 (Obsoleted by RFC 8446) Summary: 2 errors (**), 0 flaws (~~), 2 warnings (==), 2 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 HTTPbis Working Group M. Nottingham 3 Internet-Draft Akamai 4 Intended status: Standards Track P. McManus 5 Expires: April 3, 2015 Mozilla 6 J. Reschke 7 greenbytes 8 September 30, 2014 10 HTTP Alternative Services 11 draft-ietf-httpbis-alt-svc-03 13 Abstract 15 This document specifies "alternative services" for HTTP, which allow 16 an origin's resources to be authoritatively available at a separate 17 network location, possibly accessed with a different protocol 18 configuration. 20 Editorial Note (To be removed by RFC Editor) 22 Discussion of this draft takes place on the HTTPBIS working group 23 mailing list (ietf-http-wg@w3.org), which is archived at 24 . 26 Working Group information can be found at 27 and ; 28 source code and issues list for this draft can be found at 29 . 31 The changes in this draft are summarized in Appendix A. 33 Status of This Memo 35 This Internet-Draft is submitted in full conformance with the 36 provisions of BCP 78 and BCP 79. 38 Internet-Drafts are working documents of the Internet Engineering 39 Task Force (IETF). Note that other groups may also distribute 40 working documents as Internet-Drafts. The list of current Internet- 41 Drafts is at http://datatracker.ietf.org/drafts/current/. 43 Internet-Drafts are draft documents valid for a maximum of six months 44 and may be updated, replaced, or obsoleted by other documents at any 45 time. It is inappropriate to use Internet-Drafts as reference 46 material or to cite them other than as "work in progress." 48 This Internet-Draft will expire on April 3, 2015. 50 Copyright Notice 52 Copyright (c) 2014 IETF Trust and the persons identified as the 53 document authors. All rights reserved. 55 This document is subject to BCP 78 and the IETF Trust's Legal 56 Provisions Relating to IETF Documents 57 (http://trustee.ietf.org/license-info) in effect on the date of 58 publication of this document. Please review these documents 59 carefully, as they describe your rights and restrictions with respect 60 to this document. Code Components extracted from this document must 61 include Simplified BSD License text as described in Section 4.e of 62 the Trust Legal Provisions and are provided without warranty as 63 described in the Simplified BSD License. 65 Table of Contents 67 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 68 1.1. Notational Conventions . . . . . . . . . . . . . . . . . . 3 69 2. Alternative Services Concepts . . . . . . . . . . . . . . . . 4 70 2.1. Host Authentication . . . . . . . . . . . . . . . . . . . 5 71 2.2. Alternative Service Caching . . . . . . . . . . . . . . . 6 72 2.3. Requiring Server Name Indication . . . . . . . . . . . . . 6 73 2.4. Using Alternative Services . . . . . . . . . . . . . . . . 6 74 3. The Alt-Svc HTTP Header Field . . . . . . . . . . . . . . . . 7 75 3.1. Caching Alt-Svc Header Field Values . . . . . . . . . . . 9 76 4. The ALTSVC HTTP/2 Frame . . . . . . . . . . . . . . . . . . . 9 77 5. The Alt-Svc-Used HTTP Header Field . . . . . . . . . . . . . . 11 78 6. The 421 Not Authoritative HTTP Status Code . . . . . . . . . . 12 79 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 12 80 7.1. Header Field Registrations . . . . . . . . . . . . . . . . 12 81 7.2. The ALTSVC HTTP/2 Frame Type . . . . . . . . . . . . . . . 13 82 8. Internationalization Considerations . . . . . . . . . . . . . 13 83 9. Security Considerations . . . . . . . . . . . . . . . . . . . 13 84 9.1. Changing Ports . . . . . . . . . . . . . . . . . . . . . . 13 85 9.2. Changing Hosts . . . . . . . . . . . . . . . . . . . . . . 13 86 9.3. Changing Protocols . . . . . . . . . . . . . . . . . . . . 14 87 9.4. Tracking Clients Using Alternative Services . . . . . . . 14 88 10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 15 89 11. References . . . . . . . . . . . . . . . . . . . . . . . . . . 15 90 11.1. Normative References . . . . . . . . . . . . . . . . . . . 15 91 11.2. Informative References . . . . . . . . . . . . . . . . . . 16 92 Appendix A. Change Log (to be removed by RFC Editor before 93 publication) . . . . . . . . . . . . . . . . . . . . 16 94 A.1. Since draft-nottingham-httpbis-alt-svc-05 . . . . . . . . 16 95 A.2. Since draft-ietf-httpbis-alt-svc-00 . . . . . . . . . . . 16 96 A.3. Since draft-ietf-httpbis-alt-svc-01 . . . . . . . . . . . 16 97 A.4. Since draft-ietf-httpbis-alt-svc-02 . . . . . . . . . . . 16 99 1. Introduction 101 HTTP [RFC7230] conflates the identification of resources with their 102 location. In other words, "http://" (and "https://") URLs are used 103 to both name and find things to interact with. 105 In some cases, it is desirable to separate these aspects; to be able 106 to keep the same identifier for a resource, but interact with it 107 using a different location on the network. 109 For example: 111 o An origin server might wish to redirect a client to an alternative 112 when it needs to go down for maintenance, or it has found an 113 alternative in a location that is more local to the client. 115 o An origin server might wish to offer access to its resources using 116 a new protocol (such as HTTP/2, see [HTTP2]) or one using improved 117 security (such as Transport Layer Security (TLS), see [RFC5246]). 119 o An origin server might wish to segment its clients into groups of 120 capabilities, such as those supporting Server Name Indication 121 (SNI, see Section 3 of [RFC6066]) and those not supporting it, for 122 operational purposes. 124 This specification defines a new concept in HTTP, "Alternative 125 Services", that allows a resource to nominate additional means of 126 interacting with it on the network. It defines a general framework 127 for this in Section 2, along with specific mechanisms for advertising 128 their existence using HTTP header fields (Section 3) or an HTTP/2 129 frame type (Section 4). 131 It also introduces a new status code in Section 6, so that origin 132 servers (or their nominated alternatives) can indicate that they are 133 not authoritative for a given origin, in cases where the wrong 134 location is used. 136 1.1. Notational Conventions 138 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 139 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 140 document are to be interpreted as described in [RFC2119]. 142 This document uses the Augmented BNF defined in [RFC5234] along with 143 the "OWS", "delta-seconds", "parameter", "port", "quoted-string", 144 "token", and "uri-host" rules from [RFC7230], and uses the "#rule" 145 extension defined in Section 7 of that document. 147 2. Alternative Services Concepts 149 This specification defines a new concept in HTTP, the "alternative 150 service". When an origin (see [RFC6454]) has resources that are 151 accessible through a different protocol / host / port combination, it 152 is said to have an alternative service. 154 An alternative service can be used to interact with the resources on 155 an origin server at a separate location on the network, possibly 156 using a different protocol configuration. Alternative services are 157 considered authoritative for an origin's resources, in the sense of 158 [RFC7230], Section 9.1. 160 For example, an origin: 162 ("http", "www.example.com", "80") 164 might declare that its resources are also accessible at the 165 alternative service: 167 ("h2", "new.example.com", "81") 169 By their nature, alternative services are explicitly at the 170 granularity of an origin; i.e., they cannot be selectively applied to 171 resources within an origin. 173 Alternative services do not replace or change the origin for any 174 given resource; in general, they are not visible to the software 175 "above" the access mechanism. The alternative service is essentially 176 alternative routing information that can also be used to reach the 177 origin in the same way that DNS CNAME or SRV records define routing 178 information at the name resolution level. Each origin maps to a set 179 of these routes -- the default route is derived from origin itself 180 and the other routes are introduced based on alternative-protocol 181 information. 183 Furthermore, it is important to note that the first member of an 184 alternative service tuple is different from the "scheme" component of 185 an origin; it is more specific, identifying not only the major 186 version of the protocol being used, but potentially communication 187 options for that protocol. 189 This means that clients using an alternative service will change the 190 host, port and protocol that they are using to fetch resources, but 191 these changes MUST NOT be propagated to the application that is using 192 HTTP; from that standpoint, the URI being accessed and all 193 information derived from it (scheme, host, port) are the same as 194 before. 196 Importantly, this includes its security context; in particular, when 197 TLS [RFC5246] is in use, the alternative server will need to present 198 a certificate for the origin's host name, not that of the 199 alternative. Likewise, the Host header field ([RFC7230], Section 200 5.4) is still derived from the origin, not the alternative service 201 (just as it would if a CNAME were being used). 203 The changes MAY, however, be made visible in debugging tools, 204 consoles, etc. 206 Formally, an alternative service is identified by the combination of: 208 o An Application Layer Protocol Negotiation (ALPN) protocol, as per 209 [RFC7301] 211 o A host, as per [RFC3986], Section 3.2.2 213 o A port, as per [RFC3986], Section 3.2.3 215 Additionally, each alternative service MUST have: 217 o A freshness lifetime, expressed in seconds; see Section 2.2 219 There are many ways that a client could discover the alternative 220 service(s) associated with an origin. This document describes two 221 such mechanisms: an HTTP header field (Section 3) and an HTTP/2 frame 222 type (Section 4). 224 2.1. Host Authentication 226 Clients MUST NOT use alternative services with a host other than the 227 origin's without strong server authentication; this mitigates the 228 attack described in Section 9.2. One way to achieve this is for the 229 alternative to use TLS with a certificate that is valid for that 230 origin. 232 For example, if the origin's host is "www.example.com" and an 233 alternative is offered on "other.example.com" with the "h2" protocol, 234 and the certificate offered is valid for "www.example.com", the 235 client can use the alternative. However, if "other.example.com" is 236 offered with the "h2c" protocol, the client cannot use it, because 237 there is no mechanism in that protocol to establish strong server 238 authentication. 240 Furthermore, this means that the HTTP Host header field and the SNI 241 information provided in TLS by the client will be that of the origin, 242 not the alternative. 244 2.2. Alternative Service Caching 246 Mechanisms for discovering alternative services can associate a 247 freshness lifetime with them; for example, the Alt-Svc header field 248 uses the "ma" parameter. 250 Clients MAY choose to use an alternative service instead of the 251 origin at any time when it is considered fresh; see Section 2.4 for 252 specific recommendations. 254 Clients with existing connections to alternative services are not 255 needed to fall back to the origin when its freshness lifetime ends; 256 i.e., the caching mechanism is intended for limiting how long an 257 alternative service can be used for establishing new requests, not 258 limiting the use of existing ones. 260 Clients ought to consider that changes in network configurations can 261 result in suboptimal or compromised cached alternative services. 263 2.3. Requiring Server Name Indication 265 A client MUST only use a TLS-based alternative service if the client 266 also supports TLS Server Name Indication (SNI). This supports the 267 conservation of IP addresses on the alternative service host. 269 2.4. Using Alternative Services 271 By their nature, alternative services are OPTIONAL: clients do not 272 need to use them. However, it is advantageous for clients to behave 273 in a predictable way when they are used by servers (e.g., for load 274 balancing). 276 Therefore, if a client becomes aware of an alternative service, the 277 client SHOULD use that alternative service for all requests to the 278 associated origin as soon as it is available, provided that the 279 security properties of the alternative service protocol are 280 desirable, as compared to the existing connection. 282 If a client becomes aware of multiple alternative services, it MAY 283 choose the most suitable according to its own criteria (again, 284 keeping security properties in mind). For example, an origin might 285 advertise multiple alternative services to notify clients of support 286 for multiple versions of HTTP; or, an alternative service might 287 itself advertise an alternative. 289 When a client uses an alternate service, it MUST emit the Alt-Svc- 290 Used header field (Section 5) on every request using that alternate 291 service. 293 The client does not need to block requests; the origin's connection 294 can be used until the alternative connection is established. 295 However, if the security properties of the existing connection are 296 weak (e.g. cleartext HTTP/1.1) then it might make sense to block 297 until the new connection is fully available in order to avoid 298 information leakage. 300 Furthermore, if the connection to the alternative service fails or is 301 unresponsive, the client MAY fall back to using the origin. Note, 302 however, that this could be the basis of a downgrade attack, thus 303 losing any enhanced security properties of the alternative service. 305 3. The Alt-Svc HTTP Header Field 307 An HTTP(S) origin server can advertise the availability of 308 alternative services to clients by adding an Alt-Svc header field to 309 responses. 311 Alt-Svc = 1#( alternative *( OWS ";" OWS parameter ) ) 312 alternative = protocol-id "=" alt-authority 313 protocol-id = token ; percent-encoded ALPN protocol identifier 314 alt-authority = quoted-string ; containing [ uri-host ] ":" port 316 ALPN protocol names are octet sequences with no additional 317 constraints on format. Octets not allowed in tokens ([RFC7230], 318 Section 3.2.6) MUST be percent-encoded as per Section 2.1 of 319 [RFC3986]. Consequently, the octet representing the percent 320 character "%" (hex 25) MUST be percent-encoded as well. 322 In order to have precisely one way to represent any ALPN protocol 323 name, the following additional constraints apply: 325 1. Octets in the ALPN protocol MUST NOT be percent-encoded if they 326 are valid token characters except "%", and 328 2. When using percent-encoding, uppercase hex digits MUST be used. 330 With these constraints, recipients can apply simple string comparison 331 to match protocol identifiers. 333 The "alt-authority" component consists of an OPTIONAL uri-host 334 ("host" in Section 3.2.2 of [RFC3986]), a colon (":"), and a port 335 number. 337 For example: 339 Alt-Svc: h2=":8000" 341 This indicates the "h2" protocol ([HTTP2]) on the same host using the 342 indicated port 8000. 344 An example involving a change of host: 346 Alt-Svc: h2="new.example.org:80" 348 This indicates the "h2" protocol on the host "new.example.org", 349 running on port 80. Note that the "quoted-string" syntax needs to be 350 used because ":" is not an allowed character in "token". 352 Examples for protocol name escaping: 354 +--------------------+-------------+---------------------+ 355 | ALPN protocol name | protocol-id | Note | 356 +--------------------+-------------+---------------------+ 357 | h2 | h2 | No escaping needed | 358 +--------------------+-------------+---------------------+ 359 | w=x:y#z | w%3Dx%3Ay#z | "=" and ":" escaped | 360 +--------------------+-------------+---------------------+ 361 | x%y | x%25y | "%" needs escaping | 362 +--------------------+-------------+---------------------+ 364 Alt-Svc MAY occur in any HTTP response message, regardless of the 365 status code. 367 It can, however, have multiple values: 369 Alt-Svc: h2c=":8000", h2=":443" 371 The value(s) advertised by Alt-Svc can be used by clients to open a 372 new connection to one or more alternative services immediately, or 373 simultaneously with subsequent requests on the same connection. 375 To reduce the ability of servers to track individual clients over 376 time (see Section 9.4), an alternative service indication sent by a 377 client SHOULD NOT include any alternative service information other 378 than the protocol, host and port. 380 When using HTTP/2 ([HTTP2]), servers SHOULD instead send an ALTSVC 381 frame (Section 4). A single ALTSVC frame can be sent for a 382 connection; a new frame is not needed for every request. 384 Note that all field elements that allow "quoted-string" syntax MUST 385 be processed as per Section 3.2.6 of [RFC7230]. 387 3.1. Caching Alt-Svc Header Field Values 389 When an alternative service is advertised using Alt-Svc, it is 390 considered fresh for 24 hours from generation of the message. This 391 can be modified with the 'ma' (max-age) parameter; 393 Alt-Svc: h2=":443"; ma=3600 395 which indicates the number of seconds since the response was 396 generated the alternative service is considered fresh for. 398 ma = delta-seconds 400 See Section 4.2.3 of [RFC7234] for details of determining response 401 age. 403 For example, a response: 405 HTTP/1.1 200 OK 406 Content-Type: text/html 407 Cache-Control: 600 408 Age: 30 409 Alt-Svc: h2c=":8000"; ma=60 411 indicates that an alternative service is available and usable for the 412 next 60 seconds. However, the response has already been cached for 413 30 seconds (as per the Age header field value), so therefore the 414 alternative service is only fresh for the 30 seconds from when this 415 response was received, minus estimated transit time. 417 When an Alt-Svc response header field is received from an origin, its 418 value invalidates and replaces all cached alternative services for 419 that origin. 421 See Section 2.2 for general requirements on caching alternative 422 services. 424 Note that the freshness lifetime for HTTP caching (here, 600 seconds) 425 does not affect caching of Alt-Svc values. 427 4. The ALTSVC HTTP/2 Frame 429 The ALTSVC HTTP/2 frame ([HTTP2], Section 4) advertises the 430 availability of an alternative service to an HTTP/2 client. 432 The ALTSVC frame is a non-critical extension to HTTP/2. Endpoints 433 that do not support this frame can safely ignore it. 435 An ALTSVC frame on a client-initiated stream indicates that the 436 conveyed alternative service is associated with the origin of that 437 stream. 439 An ALTSVC frame on stream 0 indicates that the conveyed alternative 440 service is associated with the origin contained in the Origin field 441 of the frame. An association with an origin that the client does not 442 consider authoritative for the current connection MUST be ignored. 444 The ALTSVC frame type is 0xa (decimal 10). 446 0 1 2 3 447 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 448 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 449 | Max-Age (32) | 450 +-------------------------------+---------------+---------------+ 451 | Port (16) | Proto-Len (8) | 452 +-------------------------------+---------------+---------------+ 453 | Protocol-ID (*) | 454 +---------------+-----------------------------------------------+ 455 | Host-Len (8) | Host (*) ... 456 +---------------+-----------------------------------------------+ 457 | Origin? (*) ... 458 +---------------------------------------------------------------+ 460 ALTSVC Frame Payload 462 The ALTSVC frame contains the following fields: 464 Max-Age: An unsigned, 32-bit integer indicating the freshness 465 lifetime of the alternative service association, as per 466 Section 2.2. 468 Port: An unsigned, 16-bit integer indicating the port that the 469 alternative service is available upon. 471 Proto-Len: An unsigned, 8-bit integer indicating the length, in 472 octets, of the Protocol-ID field. 474 Protocol-ID: A sequence of bytes (length determined by "Proto-Len") 475 containing the ALPN protocol identifier of the alternative 476 service. 478 Host-Len: An unsigned, 8-bit integer indicating the length, in 479 octets, of the Host header field. 481 Host: A sequence of characters (length determined by "Host-Len") 482 containing an ASCII string indicating the host that the 483 alternative service is available upon. 485 Origin: An OPTIONAL sequence of characters (length determined by 486 subtracting the length of all preceding fields from the frame 487 length) containing the ASCII serialization of an origin 488 ([RFC6454], Section 6.2) that the alternate service is applicable 489 to. 491 The ALTSVC frame does not define any flags. 493 The ALTSVC frame is intended for receipt by clients; a server that 494 receives an ALTSVC frame MUST treat it as a connection error of type 495 PROTOCOL_ERROR. 497 The ALTSVC frame is processed hop-by-hop. An intermediary MUST NOT 498 forward ALTSVC frames, though it can use the information contained in 499 ALTSVC frames in forming new ALTSVC frames to send to its own 500 clients. 502 5. The Alt-Svc-Used HTTP Header Field 504 The Alt-Svc-Used HTTP header field is used in requests to indicate 505 that an alternate service is in use. 507 Alt-Svc-Used = use-flag *( OWS ";" OWS ext-param ) 508 use-flag = "1" / "0" 509 ext-param = token "=" ( token / quoted-string ) 511 Alt-Svc-Used is intended to allow alternate services to avoid sending 512 alternative service indications where there is a risk of generating a 513 loops. It also allows a service to identify requests for accounting 514 and load balancing purposes. 516 When using an alternative service, clients MUST include a Alt-Svc- 517 Used header field in all requests. 519 A flag value of "1" indicates that an alternate service was used, 520 while "0" means it was not. 522 For example: 524 GET /thing HTTP/1.1 525 Host: origin.example.com 526 Alt-Svc-Used: 1 528 The extension parameters (ext-param) are reserved for future use; 529 specifications that want to define an extension will need to update 530 this document (and ought to introduce an extension registry). 532 6. The 421 Not Authoritative HTTP Status Code 534 The 421 (Not Authoritative) status code is defined in [HTTP2], 535 Section 9.1.2 to indicate that the current server instance is not 536 authoritative for the requested resource. This can be used to 537 indicate that an alternative service is not authoritative; see 538 Section 2). 540 Clients receiving 421 (Not Authoritative) from an alternative service 541 MUST remove the corresponding entry from its alternative service 542 cache (see Section 2.2) for that origin. Regardless of the 543 idempotency of the request method, they MAY retry the request, either 544 at another alternative server, or at the origin. 546 A 421 (Not Authoritative) response MAY carry an Alt-Svc header field. 548 7. IANA Considerations 550 7.1. Header Field Registrations 552 HTTP header fields are registered within the "Message Headers" 553 registry maintained at 554 . 556 This document defines the following HTTP header fields, so their 557 associated registry entries shall be added according to the permanent 558 registrations below (see [BCP90]): 560 +-------------------+----------+----------+-----------+ 561 | Header Field Name | Protocol | Status | Reference | 562 +-------------------+----------+----------+-----------+ 563 | Alt-Svc | http | standard | Section 3 | 564 | Alt-Svc-Used | http | standard | Section 5 | 565 +-------------------+----------+----------+-----------+ 567 The change controller is: "IETF (iesg@ietf.org) - Internet 568 Engineering Task Force". 570 7.2. The ALTSVC HTTP/2 Frame Type 572 This document registers the ALTSVC frame type in the HTTP/2 Frame 573 Types registry ([HTTP2], Section 11.2). 575 Frame Type: ALTSVC 577 Code: 0xa 579 Specification: Section 4 of this document 581 8. Internationalization Considerations 583 An internationalized domain name that appears in either the header 584 field (Section 3) or the HTTP/2 frame (Section 4) MUST be expressed 585 using A-labels ([RFC5890], Section 2.3.2.1). 587 9. Security Considerations 589 9.1. Changing Ports 591 Using an alternative service implies accessing an origin's resources 592 on an alternative port, at a minimum. An attacker that can inject 593 alternative services and listen at the advertised port is therefore 594 able to hijack an origin. 596 For example, an attacker that can add HTTP response header fields can 597 redirect traffic to a different port on the same host using the Alt- 598 Svc header field; if that port is under the attacker's control, they 599 can thus masquerade as the HTTP server. 601 This risk can be mitigated by restricting the ability to advertise 602 alternative services, and restricting who can open a port for 603 listening on that host. 605 9.2. Changing Hosts 607 When the host is changed due to the use of an alternative service, it 608 presents an opportunity for attackers to hijack communication to an 609 origin. 611 For example, if an attacker can convince a user agent to send all 612 traffic for "innocent.example.org" to "evil.example.com" by 613 successfully associating it as an alternative service, they can 614 masquerade as that origin. This can be done locally (see mitigations 615 above) or remotely (e.g., by an intermediary as a man-in-the-middle 616 attack). 618 This is the reason for the requirement in Section 2.1 that any 619 alternative service with a host different to the origin's be strongly 620 authenticated with the origin's identity; i.e., presenting a 621 certificate for the origin proves that the alternative service is 622 authorized to serve traffic for the origin. 624 However, this authorization is only as strong as the method used to 625 authenticate the alternative service. In particular, there are well- 626 known exploits to make an attacker's certificate appear as 627 legitimate. 629 Alternative services could be used to persist such an attack; for 630 example, an intermediary could man-in-the-middle TLS-protected 631 communication to a target, and then direct all traffic to an 632 alternative service with a large freshness lifetime, so that the user 633 agent still directs traffic to the attacker even when not using the 634 intermediary. 636 9.3. Changing Protocols 638 When the ALPN protocol is changed due to the use of an alternative 639 service, the security properties of the new connection to the origin 640 can be different from that of the "normal" connection to the origin, 641 because the protocol identifier itself implies this. 643 For example, if a "https://" URI had a protocol advertised that does 644 not use some form of end-to-end encryption (most likely, TLS), it 645 violates the expectations for security that the URI scheme implies. 647 Therefore, clients cannot blindly use alternative services, but 648 instead evaluate the option(s) presented to assure that security 649 requirements and expectations (of specifications, implementations and 650 end users) are met. 652 9.4. Tracking Clients Using Alternative Services 654 The alternative service indicator (Section 5) provided by clients 655 provides a server the means of correlating requests. If the 656 alternative service indicator includes a sufficiently unique 657 identifier, requests made to an alternative service can be correlated 658 with the original alternative service advertisement. 660 Clients that do not wish to be tracked MAY choose to ignore 661 alternative service advertisements. 663 In a browser, any alternative service information MUST be removed 664 when origin-specific data is cleared (for instance, when cookies are 665 cleared). 667 10. Acknowledgements 669 Thanks to Adam Langley, Eliot Lear, Erik Nygren, Guy Podjarny, Paul 670 Hoffman, Richard Barnes, Stephen Farrell, Stephen Ludin, and Will 671 Chan for their feedback and suggestions. 673 The Alt-Svc header field was influenced by the design of the 674 Alternate-Protocol header field in SPDY. 676 11. References 678 11.1. Normative References 680 [HTTP2] Belshe, M., Peon, R., and M. Thomson, Ed., "Hypertext 681 Transfer Protocol version 2", draft-ietf-httpbis-http2-14 682 (work in progress), July 2014. 684 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 685 Requirement Levels", BCP 14, RFC 2119, March 1997. 687 [RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform 688 Resource Identifier (URI): Generic Syntax", STD 66, 689 RFC 3986, January 2005. 691 [RFC5234] Crocker, D. and P. Overell, "Augmented BNF for Syntax 692 Specifications: ABNF", STD 68, RFC 5234, January 2008. 694 [RFC5890] Klensin, J., "Internationalized Domain Names for 695 Applications (IDNA): Definitions and Document Framework", 696 RFC 5890, August 2010. 698 [RFC6066] Eastlake, D., "Transport Layer Security (TLS) Extensions: 699 Extension Definitions", RFC 6066, January 2011. 701 [RFC6454] Barth, A., "The Web Origin Concept", RFC 6454, 702 December 2011. 704 [RFC7230] Fielding, R., Ed. and J. Reschke, Ed., "Hypertext Transfer 705 Protocol (HTTP/1.1): Message Syntax and Routing", 706 RFC 7230, June 2014. 708 [RFC7234] Fielding, R., Ed., Nottingham, M., Ed., and J. Reschke, 709 Ed., "Hypertext Transfer Protocol (HTTP/1.1): Caching", 710 RFC 7234, June 2014. 712 [RFC7301] Friedl, S., Popov, A., Langley, A., and S. Emile, 713 "Transport Layer Security (TLS) Application-Layer Protocol 714 Negotiation Extension", RFC 7301, July 2014. 716 11.2. Informative References 718 [BCP90] Klyne, G., Nottingham, M., and J. Mogul, "Registration 719 Procedures for Message Header Fields", BCP 90, RFC 3864, 720 September 2004. 722 [RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security 723 (TLS) Protocol Version 1.2", RFC 5246, August 2008. 725 Appendix A. Change Log (to be removed by RFC Editor before publication) 727 A.1. Since draft-nottingham-httpbis-alt-svc-05 729 This is the first version after adoption of 730 draft-nottingham-httpbis-alt-svc-05 as Working Group work item. It 731 only contains editorial changes. 733 A.2. Since draft-ietf-httpbis-alt-svc-00 735 Selected 421 as proposed status code for "Not Authoritative". 737 Changed header field syntax to use percent-encoding of ALPN protocol 738 names (). 740 A.3. Since draft-ietf-httpbis-alt-svc-01 742 Updated HTTP/1.1 references. 744 Renamed "Service" to "Alt-Svc-Used" and reduced information to a flag 745 to address fingerprinting concerns 746 (). 748 Note that ALTSVC frame is preferred to Alt-Svc header field 749 (). 751 Incorporate ALTSRV frame 752 (). 754 Moved definition of status code 421 to HTTP/2. 756 Partly resolved . 758 A.4. Since draft-ietf-httpbis-alt-svc-02 760 Updated ALPN reference. 762 Resolved . 764 Authors' Addresses 766 Mark Nottingham 767 Akamai 769 EMail: mnot@mnot.net 770 URI: https://www.mnot.net/ 772 Patrick McManus 773 Mozilla 775 EMail: mcmanus@ducksong.com 776 URI: https://mozillians.org/u/pmcmanus/ 778 Julian F. Reschke 779 greenbytes GmbH 781 EMail: julian.reschke@greenbytes.de 782 URI: https://greenbytes.de/tech/webdav/