idnits 2.17.1
draft-ietf-httpbis-alt-svc-06.txt:
Checking boilerplate required by RFC 5378 and the IETF Trust (see
https://trustee.ietf.org/license-info):
----------------------------------------------------------------------------
No issues found here.
Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt:
----------------------------------------------------------------------------
No issues found here.
Checking nits according to https://www.ietf.org/id-info/checklist :
----------------------------------------------------------------------------
No issues found here.
Miscellaneous warnings:
----------------------------------------------------------------------------
== The copyright year in the IETF Trust and authors Copyright Line does not
match the current year
-- The document date (February 5, 2015) is 3367 days in the past. Is this
intentional?
Checking references for intended status: Proposed Standard
----------------------------------------------------------------------------
(See RFCs 3967 and 4897 for information about using normative references
to lower-maturity documents in RFCs)
== Outdated reference: A later version (-17) exists of
draft-ietf-httpbis-http2-16
** Obsolete normative reference: RFC 7230 (Obsoleted by RFC 9110, RFC 9112)
** Obsolete normative reference: RFC 7234 (Obsoleted by RFC 9111)
-- Obsolete informational reference (is this intentional?): RFC 5246
(Obsoleted by RFC 8446)
Summary: 2 errors (**), 0 flaws (~~), 2 warnings (==), 2 comments (--).
Run idnits with the --verbose option for more detailed information about
the items above.
--------------------------------------------------------------------------------
2 HTTPbis Working Group M. Nottingham
3 Internet-Draft Akamai
4 Intended status: Standards Track P. McManus
5 Expires: August 9, 2015 Mozilla
6 J. Reschke
7 greenbytes
8 February 5, 2015
10 HTTP Alternative Services
11 draft-ietf-httpbis-alt-svc-06
13 Abstract
15 This document specifies "alternative services" for HTTP, which allow
16 an origin's resources to be authoritatively available at a separate
17 network location, possibly accessed with a different protocol
18 configuration.
20 Editorial Note (To be removed by RFC Editor)
22 Discussion of this draft takes place on the HTTPBIS working group
23 mailing list (ietf-http-wg@w3.org), which is archived at
24 .
26 Working Group information can be found at
27 and ;
28 source code and issues list for this draft can be found at
29 .
31 The changes in this draft are summarized in Appendix A.
33 Status of This Memo
35 This Internet-Draft is submitted in full conformance with the
36 provisions of BCP 78 and BCP 79.
38 Internet-Drafts are working documents of the Internet Engineering
39 Task Force (IETF). Note that other groups may also distribute
40 working documents as Internet-Drafts. The list of current Internet-
41 Drafts is at http://datatracker.ietf.org/drafts/current/.
43 Internet-Drafts are draft documents valid for a maximum of six months
44 and may be updated, replaced, or obsoleted by other documents at any
45 time. It is inappropriate to use Internet-Drafts as reference
46 material or to cite them other than as "work in progress."
48 This Internet-Draft will expire on August 9, 2015.
50 Copyright Notice
52 Copyright (c) 2015 IETF Trust and the persons identified as the
53 document authors. All rights reserved.
55 This document is subject to BCP 78 and the IETF Trust's Legal
56 Provisions Relating to IETF Documents
57 (http://trustee.ietf.org/license-info) in effect on the date of
58 publication of this document. Please review these documents
59 carefully, as they describe your rights and restrictions with respect
60 to this document. Code Components extracted from this document must
61 include Simplified BSD License text as described in Section 4.e of
62 the Trust Legal Provisions and are provided without warranty as
63 described in the Simplified BSD License.
65 Table of Contents
67 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4
68 1.1. Notational Conventions . . . . . . . . . . . . . . . . . . 4
69 2. Alternative Services Concepts . . . . . . . . . . . . . . . . 5
70 2.1. Host Authentication . . . . . . . . . . . . . . . . . . . 6
71 2.2. Alternative Service Caching . . . . . . . . . . . . . . . 7
72 2.3. Requiring Server Name Indication . . . . . . . . . . . . . 7
73 2.4. Using Alternative Services . . . . . . . . . . . . . . . . 7
74 3. The Alt-Svc HTTP Header Field . . . . . . . . . . . . . . . . 8
75 3.1. Caching Alt-Svc Header Field Values . . . . . . . . . . . 10
76 4. The ALTSVC HTTP/2 Frame . . . . . . . . . . . . . . . . . . . 10
77 5. The Alt-Used HTTP Header Field . . . . . . . . . . . . . . . . 12
78 6. The 421 Misdirected Request HTTP Status Code . . . . . . . . . 12
79 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 13
80 7.1. Header Field Registrations . . . . . . . . . . . . . . . . 13
81 7.2. The ALTSVC HTTP/2 Frame Type . . . . . . . . . . . . . . . 13
82 8. Internationalization Considerations . . . . . . . . . . . . . 13
83 9. Security Considerations . . . . . . . . . . . . . . . . . . . 13
84 9.1. Changing Ports . . . . . . . . . . . . . . . . . . . . . . 13
85 9.2. Changing Hosts . . . . . . . . . . . . . . . . . . . . . . 14
86 9.3. Changing Protocols . . . . . . . . . . . . . . . . . . . . 14
87 9.4. Tracking Clients Using Alternative Services . . . . . . . 15
88 10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 15
89 11. References . . . . . . . . . . . . . . . . . . . . . . . . . . 15
90 11.1. Normative References . . . . . . . . . . . . . . . . . . . 15
91 11.2. Informative References . . . . . . . . . . . . . . . . . . 16
92 Appendix A. Change Log (to be removed by RFC Editor before
93 publication) . . . . . . . . . . . . . . . . . . . . 16
94 A.1. Since draft-nottingham-httpbis-alt-svc-05 . . . . . . . . 16
95 A.2. Since draft-ietf-httpbis-alt-svc-00 . . . . . . . . . . . 16
96 A.3. Since draft-ietf-httpbis-alt-svc-01 . . . . . . . . . . . 17
97 A.4. Since draft-ietf-httpbis-alt-svc-02 . . . . . . . . . . . 17
98 A.5. Since draft-ietf-httpbis-alt-svc-03 . . . . . . . . . . . 17
99 A.6. Since draft-ietf-httpbis-alt-svc-04 . . . . . . . . . . . 17
100 A.7. Since draft-ietf-httpbis-alt-svc-05 . . . . . . . . . . . 18
102 1. Introduction
104 HTTP [RFC7230] conflates the identification of resources with their
105 location. In other words, "http://" (and "https://") URLs are used
106 to both name and find things to interact with.
108 In some cases, it is desirable to separate identification and
109 location in HTTP; keeping the same identifier for a resource, but
110 interacting with it at a different location on the network.
112 For example:
114 o An origin server might wish to redirect a client to a different
115 server when it needs to go down for maintenance, or it has found a
116 server in a location that is more local to the client.
118 o An origin server might wish to offer access to its resources using
119 a new protocol (such as HTTP/2, see [HTTP2]) or one using improved
120 security (such as Transport Layer Security (TLS), see [RFC5246]).
122 o An origin server might wish to segment its clients into groups of
123 capabilities, such as those supporting Server Name Indication
124 (SNI, see Section 3 of [RFC6066]) and those not supporting it, for
125 operational purposes.
127 This specification defines a new concept in HTTP, "Alternative
128 Services", that allows an origin server to nominate additional means
129 of interacting with it on the network. It defines a general
130 framework for this in Section 2, along with specific mechanisms for
131 advertising their existence using HTTP header fields (Section 3) or
132 an HTTP/2 frame type (Section 4).
134 It also introduces a new status code in Section 6, so that origin
135 servers (or their nominated alternatives) can indicate that they are
136 not authoritative for a given origin, in cases where the wrong
137 location is used.
139 1.1. Notational Conventions
141 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
142 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
143 document are to be interpreted as described in [RFC2119].
145 This document uses the Augmented BNF defined in [RFC5234] along with
146 the "OWS", "delta-seconds", "parameter", "port", "quoted-string",
147 "token", and "uri-host" rules from [RFC7230], and uses the "#rule"
148 extension defined in Section 7 of that document.
150 2. Alternative Services Concepts
152 This specification defines a new concept in HTTP, the "alternative
153 service". When an origin (see [RFC6454]) has resources that are
154 accessible through a different protocol / host / port combination, it
155 is said to have an alternative service available.
157 An alternative service can be used to interact with the resources on
158 an origin server at a separate location on the network, possibly
159 using a different protocol configuration. Alternative services are
160 considered authoritative for an origin's resources, in the sense of
161 [RFC7230], Section 9.1.
163 For example, an origin:
165 ("http", "www.example.com", "80")
167 might declare that its resources are also accessible at the
168 alternative service:
170 ("h2", "new.example.com", "81")
172 By their nature, alternative services are explicitly at the
173 granularity of an origin; i.e., they cannot be selectively applied to
174 resources within an origin.
176 Alternative services do not replace or change the origin for any
177 given resource; in general, they are not visible to the software
178 "above" the access mechanism. The alternative service is essentially
179 alternative routing information that can also be used to reach the
180 origin in the same way that DNS CNAME or SRV records define routing
181 information at the name resolution level. Each origin maps to a set
182 of these routes -- the default route is derived from origin itself
183 and the other routes are introduced based on alternative-protocol
184 information.
186 Furthermore, it is important to note that the first member of an
187 alternative service tuple is different from the "scheme" component of
188 an origin; it is more specific, identifying not only the major
189 version of the protocol being used, but potentially communication
190 options for that protocol.
192 This means that clients using an alternative service can change the
193 host, port and protocol that they are using to fetch resources, but
194 these changes MUST NOT be propagated to the application that is using
195 HTTP; from that standpoint, the URI being accessed and all
196 information derived from it (scheme, host, port) are the same as
197 before.
199 Importantly, this includes its security context; in particular, when
200 TLS [RFC5246] is in use, the alternative service will need to present
201 a certificate for the origin's host name, not that of the
202 alternative. Likewise, the Host header field ([RFC7230], Section
203 5.4) is still derived from the origin, not the alternative service
204 (just as it would if a CNAME were being used).
206 The changes MAY, however, be made visible in debugging tools,
207 consoles, etc.
209 Formally, an alternative service is identified by the combination of:
211 o An Application Layer Protocol Negotiation (ALPN) protocol, as per
212 [RFC7301]
214 o A host, as per [RFC3986], Section 3.2.2
216 o A port, as per [RFC3986], Section 3.2.3
218 Additionally, each alternative service MUST have:
220 o A freshness lifetime, expressed in seconds; see Section 2.2
222 There are many ways that a client could discover the alternative
223 service(s) associated with an origin. This document describes two
224 such mechanisms: an HTTP header field (Section 3) and an HTTP/2 frame
225 type (Section 4).
227 The remainder of this section describes requirements that are common
228 to alternative services, regardless of how they are discovered.
230 2.1. Host Authentication
232 Clients MUST NOT use alternative services with a host that is
233 different than the origin's without strong server authentication;
234 this mitigates the attack described in Section 9.2. One way to
235 achieve this is for the alternative to use TLS with a certificate
236 that is valid for that origin.
238 For example, if the origin's host is "www.example.com" and an
239 alternative is offered on "other.example.com" with the "h2" protocol,
240 and the certificate offered is valid for "www.example.com", the
241 client can use the alternative. However, if "other.example.com" is
242 offered with the "h2c" protocol, the client cannot use it, because
243 there is no mechanism in that protocol to establish strong server
244 authentication.
246 2.2. Alternative Service Caching
248 Mechanisms for discovering alternative services also associate a
249 freshness lifetime with them; for example, the Alt-Svc header field
250 uses the "ma" parameter.
252 Clients MAY choose to use an alternative service instead of the
253 origin at any time when it is considered fresh; see Section 2.4 for
254 specific recommendations.
256 Clients with existing connections to an alternative service do not
257 need to stop using it when its freshness lifetime ends; i.e., the
258 caching mechanism is intended for limiting how long an alternative
259 service can be used for establishing new requests, not limiting the
260 use of existing ones.
262 Clients ought to consider that changes in network configurations can
263 result in suboptimal or compromised cached alternative services.
265 2.3. Requiring Server Name Indication
267 A client MUST only use a TLS-based alternative service if the client
268 also supports TLS Server Name Indication (SNI). This supports the
269 conservation of IP addresses on the alternative service host.
271 Note that the SNI information provided in TLS by the client will be
272 that of the origin, not the alternative (as will the Host HTTP header
273 field-value).
275 2.4. Using Alternative Services
277 By their nature, alternative services are OPTIONAL: clients do not
278 need to use them. However, it is advantageous for clients to behave
279 in a predictable way when they are used by servers (e.g., for load
280 balancing).
282 Therefore, if a client becomes aware of an alternative service, the
283 client SHOULD use that alternative service for all requests to the
284 associated origin as soon as it is available, provided that the
285 security properties of the alternative service protocol are
286 desirable, as compared to the existing connection.
288 If a client becomes aware of multiple alternative services, it MAY
289 choose the most suitable according to its own criteria (again,
290 keeping security properties in mind). For example, an origin might
291 advertise multiple alternative services to notify clients of support
292 for multiple versions of HTTP; or, an alternative service might
293 itself advertise an alternative.
295 When a client uses an alternative service for a request, it can
296 indicate this to the server using the Alt-Used header field
297 (Section 5).
299 The client does not need to block requests on any existing
300 connection; it can be used until the alternative connection is
301 established. However, if the security properties of the existing
302 connection are weak (e.g. cleartext HTTP/1.1) then it might make
303 sense to block until the new connection is fully available in order
304 to avoid information leakage.
306 Furthermore, if the connection to the alternative service fails or is
307 unresponsive, the client MAY fall back to using the origin or another
308 alternative service. Note, however, that this could be the basis of
309 a downgrade attack, thus losing any enhanced security properties of
310 the alternative service.
312 3. The Alt-Svc HTTP Header Field
314 An HTTP(S) origin server can advertise the availability of
315 alternative services to clients by adding an Alt-Svc header field to
316 responses.
318 Alt-Svc = 1#( alternative *( OWS ";" OWS parameter ) )
319 alternative = protocol-id "=" alt-authority
320 protocol-id = token ; percent-encoded ALPN protocol identifier
321 alt-authority = quoted-string ; containing [ uri-host ] ":" port
323 ALPN protocol names are octet sequences with no additional
324 constraints on format. Octets not allowed in tokens ([RFC7230],
325 Section 3.2.6) MUST be percent-encoded as per Section 2.1 of
326 [RFC3986]. Consequently, the octet representing the percent
327 character "%" (hex 25) MUST be percent-encoded as well.
329 In order to have precisely one way to represent any ALPN protocol
330 name, the following additional constraints apply:
332 1. Octets in the ALPN protocol MUST NOT be percent-encoded if they
333 are valid token characters except "%", and
335 2. When using percent-encoding, uppercase hex digits MUST be used.
337 With these constraints, recipients can apply simple string comparison
338 to match protocol identifiers.
340 The "alt-authority" component consists of an OPTIONAL uri-host
341 ("host" in Section 3.2.2 of [RFC3986]), a colon (":"), and a port
342 number.
344 For example:
346 Alt-Svc: h2=":8000"
348 This indicates the "h2" protocol ([HTTP2]) on the same host using the
349 indicated port 8000.
351 An example involving a change of host:
353 Alt-Svc: h2="new.example.org:80"
355 This indicates the "h2" protocol on the host "new.example.org",
356 running on port 80. Note that the "quoted-string" syntax needs to be
357 used because ":" is not an allowed character in "token".
359 Examples for protocol name escaping:
361 +--------------------+-------------+---------------------+
362 | ALPN protocol name | protocol-id | Note |
363 +--------------------+-------------+---------------------+
364 | h2 | h2 | No escaping needed |
365 +--------------------+-------------+---------------------+
366 | w=x:y#z | w%3Dx%3Ay#z | "=" and ":" escaped |
367 +--------------------+-------------+---------------------+
368 | x%y | x%25y | "%" needs escaping |
369 +--------------------+-------------+---------------------+
371 Alt-Svc MAY occur in any HTTP response message, regardless of the
372 status code.
374 The Alt-Svc field value can have multiple values:
376 Alt-Svc: h2c=":8000", h2=":443"
378 The value(s) advertised by Alt-Svc can be used by clients to open a
379 new connection to one or more alternative services immediately, or
380 simultaneously with subsequent requests on the same connection.
382 When using HTTP/2 ([HTTP2]), servers SHOULD instead send an ALTSVC
383 frame (Section 4). A single ALTSVC frame can be sent for a
384 connection; a new frame is not needed for every request.
386 Note that all field elements that allow "quoted-string" syntax MUST
387 be processed as per Section 3.2.6 of [RFC7230].
389 3.1. Caching Alt-Svc Header Field Values
391 When an alternative service is advertised using Alt-Svc, it is
392 considered fresh for 24 hours from generation of the message. This
393 can be modified with the 'ma' (max-age) parameter;
395 Alt-Svc: h2=":443"; ma=3600
397 which indicates the number of seconds since the response was
398 generated the alternative service is considered fresh for.
400 ma = delta-seconds
402 See Section 4.2.3 of [RFC7234] for details of determining response
403 age.
405 For example, a response:
407 HTTP/1.1 200 OK
408 Content-Type: text/html
409 Cache-Control: 600
410 Age: 30
411 Alt-Svc: h2c=":8000"; ma=60
413 indicates that an alternative service is available and usable for the
414 next 60 seconds. However, the response has already been cached for
415 30 seconds (as per the Age header field value), so therefore the
416 alternative service is only fresh for the 30 seconds from when this
417 response was received, minus estimated transit time.
419 Note that the freshness lifetime for HTTP caching (here, 600 seconds)
420 does not affect caching of Alt-Svc values.
422 When an Alt-Svc response header field is received from an origin, its
423 value invalidates and replaces all cached alternative services for
424 that origin.
426 See Section 2.2 for general requirements on caching alternative
427 services.
429 4. The ALTSVC HTTP/2 Frame
431 The ALTSVC HTTP/2 frame ([HTTP2], Section 4) advertises the
432 availability of an alternative service to an HTTP/2 client.
434 The ALTSVC frame is a non-critical extension to HTTP/2. Endpoints
435 that do not support this frame can safely ignore it.
437 An ALTSVC frame from a server to a client on a client-initiated
438 stream indicates that the conveyed alternative service is associated
439 with the origin of that stream.
441 An ALTSVC frame from a server to a client on stream 0 indicates that
442 the conveyed alternative service is associated with the origin
443 contained in the Origin field of the frame. An association with an
444 origin that the client does not consider authoritative for the
445 current connection MUST be ignored.
447 The ALTSVC frame type is 0xa (decimal 10).
449 +-------------------------------+-------------------------------+
450 | Origin-Len (16) | Origin? (*) ...
451 +-------------------------------+-------------------------------+
452 | Alt-Svc-Field-Value (*) ...
453 +---------------------------------------------------------------+
455 ALTSVC Frame Payload
457 The ALTSVC frame contains the following fields:
459 Origin-Len: An unsigned, 16-bit integer indicating the length, in
460 octets, of the Origin field.
462 Origin: An OPTIONAL sequence of characters containing the ASCII
463 serialization of an origin ([RFC6454], Section 6.2) that the
464 alternative service is applicable to.
466 Alt-Svc-Field-Value: A sequence of octets (length determined by
467 subtracting the length of all preceding fields from the frame
468 length) containing a value identical to the Alt-Svc field value
469 defined in Section 3 (ABNF production "Alt-Svc").
471 The ALTSVC frame does not define any flags.
473 The ALTSVC frame is intended for receipt by clients; a server that
474 receives an ALTSVC frame MUST treat it as a connection error of type
475 PROTOCOL_ERROR.
477 An ALTSVC frame on a client-initiated stream containing non-empty
478 "Origin" information is invalid and MUST be ignored. Likewise, an
479 ALTSVC frame on stream 0 with empty (length 0) "Origin" information
480 is invalid and MUST be ignored.
482 The ALTSVC frame is processed hop-by-hop. An intermediary MUST NOT
483 forward ALTSVC frames, though it can use the information contained in
484 ALTSVC frames in forming new ALTSVC frames to send to its own
485 clients.
487 5. The Alt-Used HTTP Header Field
489 The Alt-Used header field is used in requests to indicate the
490 identity of the alternative service in use, just as the Host header
491 field (Section 5.4 of [RFC7230]) identifies the host and port of the
492 origin.
494 Alt-Used = uri-host [ ":" port ]
496 Alt-Used is intended to allow alternative services to detect loops,
497 differentiate traffic for purposes of load balancing, and generally
498 to ensure that it is possible to identify the intended destination of
499 traffic, since introducing this information after a protocol is in
500 use has proven to be problematic.
502 When using an alternative service, clients SHOULD include a Alt-Used
503 header field in all requests.
505 As the Alt-Used header field might be used by the server for tracking
506 the client, a client MAY choose not to include it in its requests for
507 protecting its privacy (see Section 9.4).
509 For example:
511 GET /thing HTTP/1.1
512 Host: origin.example.com
513 Alt-Used: alternate.example.net
515 The extension parameters (ext-param) are reserved for future use;
516 specifications that want to define an extension will need to update
517 this document (and ought to introduce an extension registry).
519 6. The 421 Misdirected Request HTTP Status Code
521 The 421 (Misdirected Request) status code is defined in Section 9.1.2
522 of [HTTP2] to indicate that the current server instance is not
523 authoritative for the requested resource. This can be used to
524 indicate that an alternative service is not authoritative; see
525 Section 2).
527 Clients receiving 421 (Misdirected Request) from an alternative
528 service MUST remove the corresponding entry from its alternative
529 service cache (see Section 2.2) for that origin. Regardless of the
530 idempotency of the request method, they MAY retry the request, either
531 at another alternative server, or at the origin.
533 A 421 (Misdirected Request) response MAY carry an Alt-Svc header
534 field.
536 7. IANA Considerations
538 7.1. Header Field Registrations
540 HTTP header fields are registered within the "Message Headers"
541 registry maintained at
542 .
544 This document defines the following HTTP header fields, so their
545 associated registry entries shall be added according to the permanent
546 registrations below (see [BCP90]):
548 +-------------------+----------+----------+-----------+
549 | Header Field Name | Protocol | Status | Reference |
550 +-------------------+----------+----------+-----------+
551 | Alt-Svc | http | standard | Section 3 |
552 | Alt-Used | http | standard | Section 5 |
553 +-------------------+----------+----------+-----------+
555 The change controller is: "IETF (iesg@ietf.org) - Internet
556 Engineering Task Force".
558 7.2. The ALTSVC HTTP/2 Frame Type
560 This document registers the ALTSVC frame type in the HTTP/2 Frame
561 Types registry ([HTTP2], Section 11.2).
563 Frame Type: ALTSVC
565 Code: 0xa
567 Specification: Section 4 of this document
569 8. Internationalization Considerations
571 An internationalized domain name that appears in either the header
572 field (Section 3) or the HTTP/2 frame (Section 4) MUST be expressed
573 using A-labels ([RFC5890], Section 2.3.2.1).
575 9. Security Considerations
577 9.1. Changing Ports
579 Using an alternative service implies accessing an origin's resources
580 on an alternative port, at a minimum. An attacker that can inject
581 alternative services and listen at the advertised port is therefore
582 able to hijack an origin.
584 For example, an attacker that can add HTTP response header fields can
585 redirect traffic to a different port on the same host using the Alt-
586 Svc header field; if that port is under the attacker's control, they
587 can thus masquerade as the HTTP server.
589 This risk can be mitigated by restricting the ability to advertise
590 alternative services, and restricting who can open a port for
591 listening on that host.
593 9.2. Changing Hosts
595 When the host is changed due to the use of an alternative service, it
596 presents an opportunity for attackers to hijack communication to an
597 origin.
599 For example, if an attacker can convince a user agent to send all
600 traffic for "innocent.example.org" to "evil.example.com" by
601 successfully associating it as an alternative service, they can
602 masquerade as that origin. This can be done locally (see mitigations
603 in Section 9.1) or remotely (e.g., by an intermediary as a man-in-
604 the-middle attack).
606 This is the reason for the requirement in Section 2.1 that any
607 alternative service with a host different to the origin's be strongly
608 authenticated with the origin's identity; i.e., presenting a
609 certificate for the origin proves that the alternative service is
610 authorized to serve traffic for the origin.
612 However, this authorization is only as strong as the method used to
613 authenticate the alternative service. In particular, there are well-
614 known exploits to make an attacker's certificate appear as
615 legitimate.
617 Alternative services could be used to persist such an attack; for
618 example, an intermediary could man-in-the-middle TLS-protected
619 communication to a target, and then direct all traffic to an
620 alternative service with a large freshness lifetime, so that the user
621 agent still directs traffic to the attacker even when not using the
622 intermediary.
624 9.3. Changing Protocols
626 When the ALPN protocol is changed due to the use of an alternative
627 service, the security properties of the new connection to the origin
628 can be different from that of the "normal" connection to the origin,
629 because the protocol identifier itself implies this.
631 For example, if a "https://" URI had a protocol advertised that does
632 not use some form of end-to-end encryption (most likely, TLS), it
633 violates the expectations for security that the URI scheme implies.
635 Therefore, clients cannot blindly use alternative services, but
636 instead evaluate the option(s) presented to assure that security
637 requirements and expectations (of specifications, implementations and
638 end users) are met.
640 9.4. Tracking Clients Using Alternative Services
642 Choosing an alternative service implies connecting to a new, server-
643 supplied host name. By using many different (potentially unique)
644 host names, servers could conceivably track client requests.
646 Clients concerned by the additional fingerprinting can choose to
647 ignore alternative service advertisements.
649 In a browser, any alternative service information MUST be removed
650 when origin-specific data is cleared (for instance, when cookies are
651 cleared).
653 10. Acknowledgements
655 Thanks to Adam Langley, Bence Beky, Eliot Lear, Erik Nygren, Guy
656 Podjarny, Herve Ruellan, Martin Thomson, Matthew Kerwin, Paul
657 Hoffman, Richard Barnes, Stephen Farrell, Stephen Ludin, and Will
658 Chan for their feedback and suggestions.
660 The Alt-Svc header field was influenced by the design of the
661 Alternate-Protocol header field in SPDY.
663 11. References
665 11.1. Normative References
667 [HTTP2] Belshe, M., Peon, R., and M. Thomson, Ed., "Hypertext
668 Transfer Protocol version 2", draft-ietf-httpbis-http2-16
669 (work in progress), November 2014.
671 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
672 Requirement Levels", BCP 14, RFC 2119, March 1997.
674 [RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform
675 Resource Identifier (URI): Generic Syntax", STD 66,
676 RFC 3986, January 2005.
678 [RFC5234] Crocker, D. and P. Overell, "Augmented BNF for Syntax
679 Specifications: ABNF", STD 68, RFC 5234, January 2008.
681 [RFC5890] Klensin, J., "Internationalized Domain Names for
682 Applications (IDNA): Definitions and Document Framework",
683 RFC 5890, August 2010.
685 [RFC6066] Eastlake, D., "Transport Layer Security (TLS) Extensions:
686 Extension Definitions", RFC 6066, January 2011.
688 [RFC6454] Barth, A., "The Web Origin Concept", RFC 6454,
689 December 2011.
691 [RFC7230] Fielding, R., Ed. and J. Reschke, Ed., "Hypertext Transfer
692 Protocol (HTTP/1.1): Message Syntax and Routing",
693 RFC 7230, June 2014.
695 [RFC7234] Fielding, R., Ed., Nottingham, M., Ed., and J. Reschke,
696 Ed., "Hypertext Transfer Protocol (HTTP/1.1): Caching",
697 RFC 7234, June 2014.
699 [RFC7301] Friedl, S., Popov, A., Langley, A., and S. Emile,
700 "Transport Layer Security (TLS) Application-Layer Protocol
701 Negotiation Extension", RFC 7301, July 2014.
703 11.2. Informative References
705 [BCP90] Klyne, G., Nottingham, M., and J. Mogul, "Registration
706 Procedures for Message Header Fields", BCP 90, RFC 3864,
707 September 2004.
709 [RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security
710 (TLS) Protocol Version 1.2", RFC 5246, August 2008.
712 Appendix A. Change Log (to be removed by RFC Editor before publication)
714 A.1. Since draft-nottingham-httpbis-alt-svc-05
716 This is the first version after adoption of
717 draft-nottingham-httpbis-alt-svc-05 as Working Group work item. It
718 only contains editorial changes.
720 A.2. Since draft-ietf-httpbis-alt-svc-00
722 Selected 421 as proposed status code for "Not Authoritative".
724 Changed header field syntax to use percent-encoding of ALPN protocol
725 names ().
727 A.3. Since draft-ietf-httpbis-alt-svc-01
729 Updated HTTP/1.1 references.
731 Renamed "Service" to "Alt-Svc-Used" and reduced information to a flag
732 to address fingerprinting concerns
733 ().
735 Note that ALTSVC frame is preferred to Alt-Svc header field
736 ().
738 Incorporate ALTSRV frame
739 ().
741 Moved definition of status code 421 to HTTP/2.
743 Partly resolved .
745 A.4. Since draft-ietf-httpbis-alt-svc-02
747 Updated ALPN reference.
749 Resolved .
751 A.5. Since draft-ietf-httpbis-alt-svc-03
753 Renamed "Alt-Svc-Used" to "Alt-Used"
754 ().
756 Clarify ALTSVC Origin information requirements
757 ().
759 Remove/tune language with respect to tracking risks (see
760 ).
762 A.6. Since draft-ietf-httpbis-alt-svc-04
764 Mention tracking by alt-svc host name in Security Considerations
765 ().
767 "421 (Not Authoritative)" -> "421 (Misdirected Request)".
769 Allow the frame to carry multiple indicator and use the same payload
770 formats for both
771 ().
773 A.7. Since draft-ietf-httpbis-alt-svc-05
775 Go back to specifying the origin in Alt-Used, but make it a "SHOULD"
776 ().
778 Restore Origin field in ALT-SVC frame
779 ().
781 Authors' Addresses
783 Mark Nottingham
784 Akamai
786 EMail: mnot@mnot.net
787 URI: https://www.mnot.net/
789 Patrick McManus
790 Mozilla
792 EMail: mcmanus@ducksong.com
793 URI: https://mozillians.org/u/pmcmanus/
795 Julian F. Reschke
796 greenbytes GmbH
798 EMail: julian.reschke@greenbytes.de
799 URI: https://greenbytes.de/tech/webdav/