idnits 2.17.1
draft-ietf-httpbis-alt-svc-04.txt:
Checking boilerplate required by RFC 5378 and the IETF Trust (see
https://trustee.ietf.org/license-info):
----------------------------------------------------------------------------
No issues found here.
Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt:
----------------------------------------------------------------------------
No issues found here.
Checking nits according to https://www.ietf.org/id-info/checklist :
----------------------------------------------------------------------------
No issues found here.
Miscellaneous warnings:
----------------------------------------------------------------------------
== The copyright year in the IETF Trust and authors Copyright Line does not
match the current year
-- The document date (October 27, 2014) is 3462 days in the past. Is this
intentional?
Checking references for intended status: Proposed Standard
----------------------------------------------------------------------------
(See RFCs 3967 and 4897 for information about using normative references
to lower-maturity documents in RFCs)
== Outdated reference: A later version (-17) exists of
draft-ietf-httpbis-http2-14
** Obsolete normative reference: RFC 7230 (Obsoleted by RFC 9110, RFC 9112)
** Obsolete normative reference: RFC 7234 (Obsoleted by RFC 9111)
-- Obsolete informational reference (is this intentional?): RFC 5246
(Obsoleted by RFC 8446)
Summary: 2 errors (**), 0 flaws (~~), 2 warnings (==), 2 comments (--).
Run idnits with the --verbose option for more detailed information about
the items above.
--------------------------------------------------------------------------------
2 HTTPbis Working Group M. Nottingham
3 Internet-Draft Akamai
4 Intended status: Standards Track P. McManus
5 Expires: April 30, 2015 Mozilla
6 J. Reschke
7 greenbytes
8 October 27, 2014
10 HTTP Alternative Services
11 draft-ietf-httpbis-alt-svc-04
13 Abstract
15 This document specifies "alternative services" for HTTP, which allow
16 an origin's resources to be authoritatively available at a separate
17 network location, possibly accessed with a different protocol
18 configuration.
20 Editorial Note (To be removed by RFC Editor)
22 Discussion of this draft takes place on the HTTPBIS working group
23 mailing list (ietf-http-wg@w3.org), which is archived at
24 .
26 Working Group information can be found at
27 and ;
28 source code and issues list for this draft can be found at
29 .
31 The changes in this draft are summarized in Appendix A.
33 Status of This Memo
35 This Internet-Draft is submitted in full conformance with the
36 provisions of BCP 78 and BCP 79.
38 Internet-Drafts are working documents of the Internet Engineering
39 Task Force (IETF). Note that other groups may also distribute
40 working documents as Internet-Drafts. The list of current Internet-
41 Drafts is at http://datatracker.ietf.org/drafts/current/.
43 Internet-Drafts are draft documents valid for a maximum of six months
44 and may be updated, replaced, or obsoleted by other documents at any
45 time. It is inappropriate to use Internet-Drafts as reference
46 material or to cite them other than as "work in progress."
48 This Internet-Draft will expire on April 30, 2015.
50 Copyright Notice
52 Copyright (c) 2014 IETF Trust and the persons identified as the
53 document authors. All rights reserved.
55 This document is subject to BCP 78 and the IETF Trust's Legal
56 Provisions Relating to IETF Documents
57 (http://trustee.ietf.org/license-info) in effect on the date of
58 publication of this document. Please review these documents
59 carefully, as they describe your rights and restrictions with respect
60 to this document. Code Components extracted from this document must
61 include Simplified BSD License text as described in Section 4.e of
62 the Trust Legal Provisions and are provided without warranty as
63 described in the Simplified BSD License.
65 Table of Contents
67 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4
68 1.1. Notational Conventions . . . . . . . . . . . . . . . . . . 4
69 2. Alternative Services Concepts . . . . . . . . . . . . . . . . 5
70 2.1. Host Authentication . . . . . . . . . . . . . . . . . . . 6
71 2.2. Alternative Service Caching . . . . . . . . . . . . . . . 7
72 2.3. Requiring Server Name Indication . . . . . . . . . . . . . 7
73 2.4. Using Alternative Services . . . . . . . . . . . . . . . . 7
74 3. The Alt-Svc HTTP Header Field . . . . . . . . . . . . . . . . 8
75 3.1. Caching Alt-Svc Header Field Values . . . . . . . . . . . 10
76 4. The ALTSVC HTTP/2 Frame . . . . . . . . . . . . . . . . . . . 10
77 5. The Alt-Used HTTP Header Field . . . . . . . . . . . . . . . . 12
78 6. The 421 Not Authoritative HTTP Status Code . . . . . . . . . . 13
79 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 13
80 7.1. Header Field Registrations . . . . . . . . . . . . . . . . 13
81 7.2. The ALTSVC HTTP/2 Frame Type . . . . . . . . . . . . . . . 14
82 8. Internationalization Considerations . . . . . . . . . . . . . 14
83 9. Security Considerations . . . . . . . . . . . . . . . . . . . 14
84 9.1. Changing Ports . . . . . . . . . . . . . . . . . . . . . . 14
85 9.2. Changing Hosts . . . . . . . . . . . . . . . . . . . . . . 14
86 9.3. Changing Protocols . . . . . . . . . . . . . . . . . . . . 15
87 9.4. Tracking Clients Using Alternative Services . . . . . . . 15
88 10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 16
89 11. References . . . . . . . . . . . . . . . . . . . . . . . . . . 16
90 11.1. Normative References . . . . . . . . . . . . . . . . . . . 16
91 11.2. Informative References . . . . . . . . . . . . . . . . . . 17
92 Appendix A. Change Log (to be removed by RFC Editor before
93 publication) . . . . . . . . . . . . . . . . . . . . 17
94 A.1. Since draft-nottingham-httpbis-alt-svc-05 . . . . . . . . 17
95 A.2. Since draft-ietf-httpbis-alt-svc-00 . . . . . . . . . . . 17
96 A.3. Since draft-ietf-httpbis-alt-svc-01 . . . . . . . . . . . 17
97 A.4. Since draft-ietf-httpbis-alt-svc-02 . . . . . . . . . . . 17
98 A.5. Since draft-ietf-httpbis-alt-svc-03 . . . . . . . . . . . 18
100 1. Introduction
102 HTTP [RFC7230] conflates the identification of resources with their
103 location. In other words, "http://" (and "https://") URLs are used
104 to both name and find things to interact with.
106 In some cases, it is desirable to separate identification and
107 location in HTTP; keeping the same identifier for a resource, but
108 interacting with it at a different location on the network.
110 For example:
112 o An origin server might wish to redirect a client to a different
113 server when it needs to go down for maintenance, or it has found a
114 server in a location that is more local to the client.
116 o An origin server might wish to offer access to its resources using
117 a new protocol (such as HTTP/2, see [HTTP2]) or one using improved
118 security (such as Transport Layer Security (TLS), see [RFC5246]).
120 o An origin server might wish to segment its clients into groups of
121 capabilities, such as those supporting Server Name Indication
122 (SNI, see Section 3 of [RFC6066]) and those not supporting it, for
123 operational purposes.
125 This specification defines a new concept in HTTP, "Alternative
126 Services", that allows an origin server to nominate additional means
127 of interacting with it on the network. It defines a general
128 framework for this in Section 2, along with specific mechanisms for
129 advertising their existence using HTTP header fields (Section 3) or
130 an HTTP/2 frame type (Section 4).
132 It also introduces a new status code in Section 6, so that origin
133 servers (or their nominated alternatives) can indicate that they are
134 not authoritative for a given origin, in cases where the wrong
135 location is used.
137 1.1. Notational Conventions
139 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
140 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
141 document are to be interpreted as described in [RFC2119].
143 This document uses the Augmented BNF defined in [RFC5234] along with
144 the "OWS", "delta-seconds", "parameter", "port", "quoted-string",
145 "token", and "uri-host" rules from [RFC7230], and uses the "#rule"
146 extension defined in Section 7 of that document.
148 2. Alternative Services Concepts
150 This specification defines a new concept in HTTP, the "alternative
151 service". When an origin (see [RFC6454]) has resources that are
152 accessible through a different protocol / host / port combination, it
153 is said to have an alternative service available.
155 An alternative service can be used to interact with the resources on
156 an origin server at a separate location on the network, possibly
157 using a different protocol configuration. Alternative services are
158 considered authoritative for an origin's resources, in the sense of
159 [RFC7230], Section 9.1.
161 For example, an origin:
163 ("http", "www.example.com", "80")
165 might declare that its resources are also accessible at the
166 alternative service:
168 ("h2", "new.example.com", "81")
170 By their nature, alternative services are explicitly at the
171 granularity of an origin; i.e., they cannot be selectively applied to
172 resources within an origin.
174 Alternative services do not replace or change the origin for any
175 given resource; in general, they are not visible to the software
176 "above" the access mechanism. The alternative service is essentially
177 alternative routing information that can also be used to reach the
178 origin in the same way that DNS CNAME or SRV records define routing
179 information at the name resolution level. Each origin maps to a set
180 of these routes -- the default route is derived from origin itself
181 and the other routes are introduced based on alternative-protocol
182 information.
184 Furthermore, it is important to note that the first member of an
185 alternative service tuple is different from the "scheme" component of
186 an origin; it is more specific, identifying not only the major
187 version of the protocol being used, but potentially communication
188 options for that protocol.
190 This means that clients using an alternative service can change the
191 host, port and protocol that they are using to fetch resources, but
192 these changes MUST NOT be propagated to the application that is using
193 HTTP; from that standpoint, the URI being accessed and all
194 information derived from it (scheme, host, port) are the same as
195 before.
197 Importantly, this includes its security context; in particular, when
198 TLS [RFC5246] is in use, the alternative service will need to present
199 a certificate for the origin's host name, not that of the
200 alternative. Likewise, the Host header field ([RFC7230], Section
201 5.4) is still derived from the origin, not the alternative service
202 (just as it would if a CNAME were being used).
204 The changes MAY, however, be made visible in debugging tools,
205 consoles, etc.
207 Formally, an alternative service is identified by the combination of:
209 o An Application Layer Protocol Negotiation (ALPN) protocol, as per
210 [RFC7301]
212 o A host, as per [RFC3986], Section 3.2.2
214 o A port, as per [RFC3986], Section 3.2.3
216 Additionally, each alternative service MUST have:
218 o A freshness lifetime, expressed in seconds; see Section 2.2
220 There are many ways that a client could discover the alternative
221 service(s) associated with an origin. This document describes two
222 such mechanisms: an HTTP header field (Section 3) and an HTTP/2 frame
223 type (Section 4).
225 The remainder of this section describes requirements that are common
226 to alternative services, regardless of how they are discovered.
228 2.1. Host Authentication
230 Clients MUST NOT use alternative services with a host that is
231 different than the origin's without strong server authentication;
232 this mitigates the attack described in Section 9.2. One way to
233 achieve this is for the alternative to use TLS with a certificate
234 that is valid for that origin.
236 For example, if the origin's host is "www.example.com" and an
237 alternative is offered on "other.example.com" with the "h2" protocol,
238 and the certificate offered is valid for "www.example.com", the
239 client can use the alternative. However, if "other.example.com" is
240 offered with the "h2c" protocol, the client cannot use it, because
241 there is no mechanism in that protocol to establish strong server
242 authentication.
244 2.2. Alternative Service Caching
246 Mechanisms for discovering alternative services also associate a
247 freshness lifetime with them; for example, the Alt-Svc header field
248 uses the "ma" parameter.
250 Clients MAY choose to use an alternative service instead of the
251 origin at any time when it is considered fresh; see Section 2.4 for
252 specific recommendations.
254 Clients with existing connections to an alternative service do not
255 need to stop using it when its freshness lifetime ends; i.e., the
256 caching mechanism is intended for limiting how long an alternative
257 service can be used for establishing new requests, not limiting the
258 use of existing ones.
260 Clients ought to consider that changes in network configurations can
261 result in suboptimal or compromised cached alternative services.
263 2.3. Requiring Server Name Indication
265 A client MUST only use a TLS-based alternative service if the client
266 also supports TLS Server Name Indication (SNI). This supports the
267 conservation of IP addresses on the alternative service host.
269 Note that the SNI information provided in TLS by the client will be
270 that of the origin, not the alternative (as will the Host HTTP header
271 field-value).
273 2.4. Using Alternative Services
275 By their nature, alternative services are OPTIONAL: clients do not
276 need to use them. However, it is advantageous for clients to behave
277 in a predictable way when they are used by servers (e.g., for load
278 balancing).
280 Therefore, if a client becomes aware of an alternative service, the
281 client SHOULD use that alternative service for all requests to the
282 associated origin as soon as it is available, provided that the
283 security properties of the alternative service protocol are
284 desirable, as compared to the existing connection.
286 If a client becomes aware of multiple alternative services, it MAY
287 choose the most suitable according to its own criteria (again,
288 keeping security properties in mind). For example, an origin might
289 advertise multiple alternative services to notify clients of support
290 for multiple versions of HTTP; or, an alternative service might
291 itself advertise an alternative.
293 When a client uses an alternate service, it MUST emit the Alt-Used
294 header field (Section 5) on every request using that alternate
295 service.
297 The client does not need to block requests on any existing
298 connection; it can be used until the alternative connection is
299 established. However, if the security properties of the existing
300 connection are weak (e.g. cleartext HTTP/1.1) then it might make
301 sense to block until the new connection is fully available in order
302 to avoid information leakage.
304 Furthermore, if the connection to the alternative service fails or is
305 unresponsive, the client MAY fall back to using the origin or another
306 alternative service. Note, however, that this could be the basis of
307 a downgrade attack, thus losing any enhanced security properties of
308 the alternative service.
310 3. The Alt-Svc HTTP Header Field
312 An HTTP(S) origin server can advertise the availability of
313 alternative services to clients by adding an Alt-Svc header field to
314 responses.
316 Alt-Svc = 1#( alternative *( OWS ";" OWS parameter ) )
317 alternative = protocol-id "=" alt-authority
318 protocol-id = token ; percent-encoded ALPN protocol identifier
319 alt-authority = quoted-string ; containing [ uri-host ] ":" port
321 ALPN protocol names are octet sequences with no additional
322 constraints on format. Octets not allowed in tokens ([RFC7230],
323 Section 3.2.6) MUST be percent-encoded as per Section 2.1 of
324 [RFC3986]. Consequently, the octet representing the percent
325 character "%" (hex 25) MUST be percent-encoded as well.
327 In order to have precisely one way to represent any ALPN protocol
328 name, the following additional constraints apply:
330 1. Octets in the ALPN protocol MUST NOT be percent-encoded if they
331 are valid token characters except "%", and
333 2. When using percent-encoding, uppercase hex digits MUST be used.
335 With these constraints, recipients can apply simple string comparison
336 to match protocol identifiers.
338 The "alt-authority" component consists of an OPTIONAL uri-host
339 ("host" in Section 3.2.2 of [RFC3986]), a colon (":"), and a port
340 number.
342 For example:
344 Alt-Svc: h2=":8000"
346 This indicates the "h2" protocol ([HTTP2]) on the same host using the
347 indicated port 8000.
349 An example involving a change of host:
351 Alt-Svc: h2="new.example.org:80"
353 This indicates the "h2" protocol on the host "new.example.org",
354 running on port 80. Note that the "quoted-string" syntax needs to be
355 used because ":" is not an allowed character in "token".
357 Examples for protocol name escaping:
359 +--------------------+-------------+---------------------+
360 | ALPN protocol name | protocol-id | Note |
361 +--------------------+-------------+---------------------+
362 | h2 | h2 | No escaping needed |
363 +--------------------+-------------+---------------------+
364 | w=x:y#z | w%3Dx%3Ay#z | "=" and ":" escaped |
365 +--------------------+-------------+---------------------+
366 | x%y | x%25y | "%" needs escaping |
367 +--------------------+-------------+---------------------+
369 Alt-Svc MAY occur in any HTTP response message, regardless of the
370 status code.
372 The Alt-Svc field value can have multiple values:
374 Alt-Svc: h2c=":8000", h2=":443"
376 The value(s) advertised by Alt-Svc can be used by clients to open a
377 new connection to one or more alternative services immediately, or
378 simultaneously with subsequent requests on the same connection.
380 When using HTTP/2 ([HTTP2]), servers SHOULD instead send an ALTSVC
381 frame (Section 4). A single ALTSVC frame can be sent for a
382 connection; a new frame is not needed for every request.
384 Note that all field elements that allow "quoted-string" syntax MUST
385 be processed as per Section 3.2.6 of [RFC7230].
387 3.1. Caching Alt-Svc Header Field Values
389 When an alternative service is advertised using Alt-Svc, it is
390 considered fresh for 24 hours from generation of the message. This
391 can be modified with the 'ma' (max-age) parameter;
393 Alt-Svc: h2=":443"; ma=3600
395 which indicates the number of seconds since the response was
396 generated the alternative service is considered fresh for.
398 ma = delta-seconds
400 See Section 4.2.3 of [RFC7234] for details of determining response
401 age.
403 For example, a response:
405 HTTP/1.1 200 OK
406 Content-Type: text/html
407 Cache-Control: 600
408 Age: 30
409 Alt-Svc: h2c=":8000"; ma=60
411 indicates that an alternative service is available and usable for the
412 next 60 seconds. However, the response has already been cached for
413 30 seconds (as per the Age header field value), so therefore the
414 alternative service is only fresh for the 30 seconds from when this
415 response was received, minus estimated transit time.
417 Note that the freshness lifetime for HTTP caching (here, 600 seconds)
418 does not affect caching of Alt-Svc values.
420 When an Alt-Svc response header field is received from an origin, its
421 value invalidates and replaces all cached alternative services for
422 that origin.
424 See Section 2.2 for general requirements on caching alternative
425 services.
427 4. The ALTSVC HTTP/2 Frame
429 The ALTSVC HTTP/2 frame ([HTTP2], Section 4) advertises the
430 availability of an alternative service to an HTTP/2 client.
432 The ALTSVC frame is a non-critical extension to HTTP/2. Endpoints
433 that do not support this frame can safely ignore it.
435 An ALTSVC frame from a server to a client on a client-initiated
436 stream indicates that the conveyed alternative service is associated
437 with the origin of that stream.
439 An ALTSVC frame from a server to a client on stream 0 indicates that
440 the conveyed alternative service is associated with the origin
441 contained in the Origin field of the frame. An association with an
442 origin that the client does not consider authoritative for the
443 current connection MUST be ignored.
445 The ALTSVC frame type is 0xa (decimal 10).
447 0 1 2 3
448 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
449 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
450 | Max-Age (32) |
451 +-------------------------------+---------------+---------------+
452 | Port (16) | Proto-Len (8) |
453 +-------------------------------+---------------+---------------+
454 | Protocol-ID (*) |
455 +---------------+-----------------------------------------------+
456 | Host-Len (8) | Host (*) ...
457 +---------------+-----------------------------------------------+
458 | Origin? (*) ...
459 +---------------------------------------------------------------+
461 ALTSVC Frame Payload
463 The ALTSVC frame contains the following fields:
465 Max-Age: An unsigned, 32-bit integer indicating the freshness
466 lifetime of the alternative service association, as per
467 Section 2.2.
469 Port: An unsigned, 16-bit integer indicating the port that the
470 alternative service is available upon.
472 Proto-Len: An unsigned, 8-bit integer indicating the length, in
473 octets, of the Protocol-ID field.
475 Protocol-ID: A sequence of bytes (length determined by "Proto-Len")
476 containing the ALPN protocol identifier of the alternative
477 service.
479 Host-Len: An unsigned, 8-bit integer indicating the length, in
480 octets, of the Host header field.
482 Host: A sequence of characters (length determined by "Host-Len")
483 containing an ASCII string indicating the host that the
484 alternative service is available upon.
486 Origin: An OPTIONAL sequence of characters (length determined by
487 subtracting the length of all preceding fields from the frame
488 length) containing the ASCII serialization of an origin
489 ([RFC6454], Section 6.2) that the alternate service is applicable
490 to.
492 The ALTSVC frame does not define any flags.
494 The ALTSVC frame is intended for receipt by clients; a server that
495 receives an ALTSVC frame MUST treat it as a connection error of type
496 PROTOCOL_ERROR.
498 An ALTSVC frame on a client-initiated stream containing non-empty
499 "Origin" information is invalid and MUST be ignored. Likewise, an
500 ALTSVC frame on stream 0 with empty (length 0) "Origin" information
501 is invalid and MUST be ignored.
503 The ALTSVC frame is processed hop-by-hop. An intermediary MUST NOT
504 forward ALTSVC frames, though it can use the information contained in
505 ALTSVC frames in forming new ALTSVC frames to send to its own
506 clients.
508 5. The Alt-Used HTTP Header Field
510 The Alt-Used header field is used in requests to indicate that an
511 alternate service is in use.
513 Alt-Used = use-flag *( OWS ";" OWS ext-param )
514 use-flag = "1" / "0"
515 ext-param = token "=" ( token / quoted-string )
517 Alt-Used is intended to allow alternate services to avoid sending
518 alternative service indications where there is a risk of generating a
519 loops. It also allows a service to identify requests for accounting
520 and load balancing purposes.
522 When using an alternative service, clients MUST include a Alt-Used
523 header field in all requests.
525 A flag value of "1" indicates that an alternate service was used,
526 while "0" means it was not.
528 For example:
530 GET /thing HTTP/1.1
531 Host: origin.example.com
532 Alt-Used: 1
534 The extension parameters (ext-param) are reserved for future use;
535 specifications that want to define an extension will need to update
536 this document (and ought to introduce an extension registry).
538 6. The 421 Not Authoritative HTTP Status Code
540 The 421 (Not Authoritative) status code is defined in [HTTP2],
541 Section 9.1.2 to indicate that the current server instance is not
542 authoritative for the requested resource. This can be used to
543 indicate that an alternative service is not authoritative; see
544 Section 2).
546 Clients receiving 421 (Not Authoritative) from an alternative service
547 MUST remove the corresponding entry from its alternative service
548 cache (see Section 2.2) for that origin. Regardless of the
549 idempotency of the request method, they MAY retry the request, either
550 at another alternative server, or at the origin.
552 A 421 (Not Authoritative) response MAY carry an Alt-Svc header field.
554 7. IANA Considerations
556 7.1. Header Field Registrations
558 HTTP header fields are registered within the "Message Headers"
559 registry maintained at
560 .
562 This document defines the following HTTP header fields, so their
563 associated registry entries shall be added according to the permanent
564 registrations below (see [BCP90]):
566 +-------------------+----------+----------+-----------+
567 | Header Field Name | Protocol | Status | Reference |
568 +-------------------+----------+----------+-----------+
569 | Alt-Svc | http | standard | Section 3 |
570 | Alt-Used | http | standard | Section 5 |
571 +-------------------+----------+----------+-----------+
573 The change controller is: "IETF (iesg@ietf.org) - Internet
574 Engineering Task Force".
576 7.2. The ALTSVC HTTP/2 Frame Type
578 This document registers the ALTSVC frame type in the HTTP/2 Frame
579 Types registry ([HTTP2], Section 11.2).
581 Frame Type: ALTSVC
583 Code: 0xa
585 Specification: Section 4 of this document
587 8. Internationalization Considerations
589 An internationalized domain name that appears in either the header
590 field (Section 3) or the HTTP/2 frame (Section 4) MUST be expressed
591 using A-labels ([RFC5890], Section 2.3.2.1).
593 9. Security Considerations
595 9.1. Changing Ports
597 Using an alternative service implies accessing an origin's resources
598 on an alternative port, at a minimum. An attacker that can inject
599 alternative services and listen at the advertised port is therefore
600 able to hijack an origin.
602 For example, an attacker that can add HTTP response header fields can
603 redirect traffic to a different port on the same host using the Alt-
604 Svc header field; if that port is under the attacker's control, they
605 can thus masquerade as the HTTP server.
607 This risk can be mitigated by restricting the ability to advertise
608 alternative services, and restricting who can open a port for
609 listening on that host.
611 9.2. Changing Hosts
613 When the host is changed due to the use of an alternative service, it
614 presents an opportunity for attackers to hijack communication to an
615 origin.
617 For example, if an attacker can convince a user agent to send all
618 traffic for "innocent.example.org" to "evil.example.com" by
619 successfully associating it as an alternative service, they can
620 masquerade as that origin. This can be done locally (see mitigations
621 in Section 9.1) or remotely (e.g., by an intermediary as a man-in-
622 the-middle attack).
624 This is the reason for the requirement in Section 2.1 that any
625 alternative service with a host different to the origin's be strongly
626 authenticated with the origin's identity; i.e., presenting a
627 certificate for the origin proves that the alternative service is
628 authorized to serve traffic for the origin.
630 However, this authorization is only as strong as the method used to
631 authenticate the alternative service. In particular, there are well-
632 known exploits to make an attacker's certificate appear as
633 legitimate.
635 Alternative services could be used to persist such an attack; for
636 example, an intermediary could man-in-the-middle TLS-protected
637 communication to a target, and then direct all traffic to an
638 alternative service with a large freshness lifetime, so that the user
639 agent still directs traffic to the attacker even when not using the
640 intermediary.
642 9.3. Changing Protocols
644 When the ALPN protocol is changed due to the use of an alternative
645 service, the security properties of the new connection to the origin
646 can be different from that of the "normal" connection to the origin,
647 because the protocol identifier itself implies this.
649 For example, if a "https://" URI had a protocol advertised that does
650 not use some form of end-to-end encryption (most likely, TLS), it
651 violates the expectations for security that the URI scheme implies.
653 Therefore, clients cannot blindly use alternative services, but
654 instead evaluate the option(s) presented to assure that security
655 requirements and expectations (of specifications, implementations and
656 end users) are met.
658 9.4. Tracking Clients Using Alternative Services
660 The Alt-Used header field (Section 5) provides a server with one
661 additional bit of information that can be used to correlate requests.
663 Clients concerned by the additional fingerprinting can choose to
664 ignore alternative service advertisements.
666 In a browser, any alternative service information MUST be removed
667 when origin-specific data is cleared (for instance, when cookies are
668 cleared).
670 10. Acknowledgements
672 Thanks to Adam Langley, Eliot Lear, Erik Nygren, Guy Podjarny, Paul
673 Hoffman, Richard Barnes, Stephen Farrell, Stephen Ludin, and Will
674 Chan for their feedback and suggestions.
676 The Alt-Svc header field was influenced by the design of the
677 Alternate-Protocol header field in SPDY.
679 11. References
681 11.1. Normative References
683 [HTTP2] Belshe, M., Peon, R., and M. Thomson, Ed., "Hypertext
684 Transfer Protocol version 2", draft-ietf-httpbis-http2-14
685 (work in progress), July 2014.
687 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
688 Requirement Levels", BCP 14, RFC 2119, March 1997.
690 [RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform
691 Resource Identifier (URI): Generic Syntax", STD 66,
692 RFC 3986, January 2005.
694 [RFC5234] Crocker, D. and P. Overell, "Augmented BNF for Syntax
695 Specifications: ABNF", STD 68, RFC 5234, January 2008.
697 [RFC5890] Klensin, J., "Internationalized Domain Names for
698 Applications (IDNA): Definitions and Document Framework",
699 RFC 5890, August 2010.
701 [RFC6066] Eastlake, D., "Transport Layer Security (TLS) Extensions:
702 Extension Definitions", RFC 6066, January 2011.
704 [RFC6454] Barth, A., "The Web Origin Concept", RFC 6454,
705 December 2011.
707 [RFC7230] Fielding, R., Ed. and J. Reschke, Ed., "Hypertext Transfer
708 Protocol (HTTP/1.1): Message Syntax and Routing",
709 RFC 7230, June 2014.
711 [RFC7234] Fielding, R., Ed., Nottingham, M., Ed., and J. Reschke,
712 Ed., "Hypertext Transfer Protocol (HTTP/1.1): Caching",
713 RFC 7234, June 2014.
715 [RFC7301] Friedl, S., Popov, A., Langley, A., and S. Emile,
716 "Transport Layer Security (TLS) Application-Layer Protocol
717 Negotiation Extension", RFC 7301, July 2014.
719 11.2. Informative References
721 [BCP90] Klyne, G., Nottingham, M., and J. Mogul, "Registration
722 Procedures for Message Header Fields", BCP 90, RFC 3864,
723 September 2004.
725 [RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security
726 (TLS) Protocol Version 1.2", RFC 5246, August 2008.
728 Appendix A. Change Log (to be removed by RFC Editor before publication)
730 A.1. Since draft-nottingham-httpbis-alt-svc-05
732 This is the first version after adoption of
733 draft-nottingham-httpbis-alt-svc-05 as Working Group work item. It
734 only contains editorial changes.
736 A.2. Since draft-ietf-httpbis-alt-svc-00
738 Selected 421 as proposed status code for "Not Authoritative".
740 Changed header field syntax to use percent-encoding of ALPN protocol
741 names ().
743 A.3. Since draft-ietf-httpbis-alt-svc-01
745 Updated HTTP/1.1 references.
747 Renamed "Service" to "Alt-Svc-Used" and reduced information to a flag
748 to address fingerprinting concerns
749 ().
751 Note that ALTSVC frame is preferred to Alt-Svc header field
752 ().
754 Incorporate ALTSRV frame
755 ().
757 Moved definition of status code 421 to HTTP/2.
759 Partly resolved .
761 A.4. Since draft-ietf-httpbis-alt-svc-02
763 Updated ALPN reference.
765 Resolved .
767 A.5. Since draft-ietf-httpbis-alt-svc-03
769 Renamed "Alt-Svc-Used" to "Alt-Used"
770 ().
772 Clarify ALTSVC Origin information requirements
773 ().
775 Remove/tune language with respect to tracking risks (see
776 ).
778 Authors' Addresses
780 Mark Nottingham
781 Akamai
783 EMail: mnot@mnot.net
784 URI: https://www.mnot.net/
786 Patrick McManus
787 Mozilla
789 EMail: mcmanus@ducksong.com
790 URI: https://mozillians.org/u/pmcmanus/
792 Julian F. Reschke
793 greenbytes GmbH
795 EMail: julian.reschke@greenbytes.de
796 URI: https://greenbytes.de/tech/webdav/