idnits 2.17.1 draft-ietf-httpbis-alt-svc-07.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (May 15, 2015) is 3263 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) ** Obsolete normative reference: RFC 7230 (Obsoleted by RFC 9110, RFC 9112) ** Obsolete normative reference: RFC 7234 (Obsoleted by RFC 9111) ** Obsolete normative reference: RFC 7540 (Obsoleted by RFC 9113) -- Obsolete informational reference (is this intentional?): RFC 5246 (Obsoleted by RFC 8446) Summary: 3 errors (**), 0 flaws (~~), 1 warning (==), 2 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 HTTP Working Group M. Nottingham 3 Internet-Draft Akamai 4 Intended status: Standards Track P. McManus 5 Expires: November 16, 2015 Mozilla 6 J. Reschke 7 greenbytes 8 May 15, 2015 10 HTTP Alternative Services 11 draft-ietf-httpbis-alt-svc-07 13 Abstract 15 This document specifies "alternative services" for HTTP, which allow 16 an origin's resources to be authoritatively available at a separate 17 network location, possibly accessed with a different protocol 18 configuration. 20 Editorial Note (To be removed by RFC Editor) 22 Discussion of this draft takes place on the HTTPBIS working group 23 mailing list (ietf-http-wg@w3.org), which is archived at 24 . 26 Working Group information can be found at 27 and ; 28 source code and issues list for this draft can be found at 29 . 31 The changes in this draft are summarized in Appendix A. 33 Status of This Memo 35 This Internet-Draft is submitted in full conformance with the 36 provisions of BCP 78 and BCP 79. 38 Internet-Drafts are working documents of the Internet Engineering 39 Task Force (IETF). Note that other groups may also distribute 40 working documents as Internet-Drafts. The list of current Internet- 41 Drafts is at http://datatracker.ietf.org/drafts/current/. 43 Internet-Drafts are draft documents valid for a maximum of six months 44 and may be updated, replaced, or obsoleted by other documents at any 45 time. It is inappropriate to use Internet-Drafts as reference 46 material or to cite them other than as "work in progress." 48 This Internet-Draft will expire on November 16, 2015. 50 Copyright Notice 52 Copyright (c) 2015 IETF Trust and the persons identified as the 53 document authors. All rights reserved. 55 This document is subject to BCP 78 and the IETF Trust's Legal 56 Provisions Relating to IETF Documents 57 (http://trustee.ietf.org/license-info) in effect on the date of 58 publication of this document. Please review these documents 59 carefully, as they describe your rights and restrictions with respect 60 to this document. Code Components extracted from this document must 61 include Simplified BSD License text as described in Section 4.e of 62 the Trust Legal Provisions and are provided without warranty as 63 described in the Simplified BSD License. 65 Table of Contents 67 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4 68 1.1. Notational Conventions . . . . . . . . . . . . . . . . . . 4 69 2. Alternative Services Concepts . . . . . . . . . . . . . . . . 5 70 2.1. Host Authentication . . . . . . . . . . . . . . . . . . . 6 71 2.2. Alternative Service Caching . . . . . . . . . . . . . . . 7 72 2.3. Requiring Server Name Indication . . . . . . . . . . . . . 7 73 2.4. Using Alternative Services . . . . . . . . . . . . . . . . 7 74 3. The Alt-Svc HTTP Header Field . . . . . . . . . . . . . . . . 8 75 3.1. Caching Alt-Svc Header Field Values . . . . . . . . . . . 10 76 4. The ALTSVC HTTP/2 Frame . . . . . . . . . . . . . . . . . . . 11 77 5. The Alt-Used HTTP Header Field . . . . . . . . . . . . . . . . 12 78 6. The 421 Misdirected Request HTTP Status Code . . . . . . . . . 12 79 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 13 80 7.1. Header Field Registrations . . . . . . . . . . . . . . . . 13 81 7.2. The ALTSVC HTTP/2 Frame Type . . . . . . . . . . . . . . . 13 82 8. Internationalization Considerations . . . . . . . . . . . . . 14 83 9. Security Considerations . . . . . . . . . . . . . . . . . . . 14 84 9.1. Changing Ports . . . . . . . . . . . . . . . . . . . . . . 14 85 9.2. Changing Hosts . . . . . . . . . . . . . . . . . . . . . . 14 86 9.3. Changing Protocols . . . . . . . . . . . . . . . . . . . . 15 87 9.4. Tracking Clients Using Alternative Services . . . . . . . 15 88 9.5. Confusion Regarding Request Scheme . . . . . . . . . . . . 15 89 10. References . . . . . . . . . . . . . . . . . . . . . . . . . . 15 90 10.1. Normative References . . . . . . . . . . . . . . . . . . . 15 91 10.2. Informative References . . . . . . . . . . . . . . . . . . 16 92 Appendix A. Change Log (to be removed by RFC Editor before 93 publication) . . . . . . . . . . . . . . . . . . . . 17 94 A.1. Since draft-nottingham-httpbis-alt-svc-05 . . . . . . . . 17 95 A.2. Since draft-ietf-httpbis-alt-svc-00 . . . . . . . . . . . 17 96 A.3. Since draft-ietf-httpbis-alt-svc-01 . . . . . . . . . . . 17 97 A.4. Since draft-ietf-httpbis-alt-svc-02 . . . . . . . . . . . 17 98 A.5. Since draft-ietf-httpbis-alt-svc-03 . . . . . . . . . . . 17 99 A.6. Since draft-ietf-httpbis-alt-svc-04 . . . . . . . . . . . 18 100 A.7. Since draft-ietf-httpbis-alt-svc-05 . . . . . . . . . . . 18 101 A.8. Since draft-ietf-httpbis-alt-svc-06 . . . . . . . . . . . 18 102 Appendix B. Acknowledgements . . . . . . . . . . . . . . . . . . 19 104 1. Introduction 106 HTTP [RFC7230] conflates the identification of resources with their 107 location. In other words, "http://" (and "https://") URLs are used 108 to both name and find things to interact with. 110 In some cases, it is desirable to separate identification and 111 location in HTTP; keeping the same identifier for a resource, but 112 interacting with it at a different location on the network. 114 For example: 116 o An origin server might wish to redirect a client to a different 117 server when it needs to go down for maintenance, or it has found a 118 server in a location that is more local to the client. 120 o An origin server might wish to offer access to its resources using 121 a new protocol (such as HTTP/2, see [RFC7540]) or one using 122 improved security (such as Transport Layer Security (TLS), see 123 [RFC5246]). 125 o An origin server might wish to segment its clients into groups of 126 capabilities, such as those supporting Server Name Indication 127 (SNI, see Section 3 of [RFC6066]) and those not supporting it, for 128 operational purposes. 130 This specification defines a new concept in HTTP, "Alternative 131 Services", that allows an origin server to nominate additional means 132 of interacting with it on the network. It defines a general 133 framework for this in Section 2, along with specific mechanisms for 134 advertising their existence using HTTP header fields (Section 3) or 135 HTTP/2 frames (Section 4), plus a way to indicate that an alternative 136 service was used (Section 5). 138 It also introduces a new status code in Section 6, so that origin 139 servers (or their nominated alternatives) can indicate that they are 140 not authoritative for a given origin, in cases where the wrong 141 location is used. 143 1.1. Notational Conventions 145 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 146 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 147 document are to be interpreted as described in [RFC2119]. 149 This document uses the Augmented BNF defined in [RFC5234] along with 150 the "#rule" extension defined in Section 7 of [RFC7230]. The rules 151 below are defined in [RFC7230] and [RFC7234]: 153 OWS = 154 delta-seconds = 155 port = 156 quoted-string = 157 token = 158 uri-host = 160 2. Alternative Services Concepts 162 This specification defines a new concept in HTTP, the "alternative 163 service". When an origin (see [RFC6454]) has resources that are 164 accessible through a different protocol / host / port combination, it 165 is said to have an alternative service available. 167 An alternative service can be used to interact with the resources on 168 an origin server at a separate location on the network, possibly 169 using a different protocol configuration. Alternative services are 170 considered authoritative for an origin's resources, in the sense of 171 [RFC7230], Section 9.1. 173 For example, an origin: 175 ("http", "www.example.com", "80") 177 might declare that its resources are also accessible at the 178 alternative service: 180 ("h2", "new.example.com", "81") 182 By their nature, alternative services are explicitly at the 183 granularity of an origin; i.e., they cannot be selectively applied to 184 resources within an origin. 186 Alternative services do not replace or change the origin for any 187 given resource; in general, they are not visible to the software 188 "above" the access mechanism. The alternative service is essentially 189 alternative routing information that can also be used to reach the 190 origin in the same way that DNS CNAME or SRV records define routing 191 information at the name resolution level. Each origin maps to a set 192 of these routes -- the default route is derived from origin itself 193 and the other routes are introduced based on alternative-protocol 194 information. 196 Furthermore, it is important to note that the first member of an 197 alternative service tuple is different from the "scheme" component of 198 an origin; it is more specific, identifying not only the major 199 version of the protocol being used, but potentially communication 200 options for that protocol. 202 This means that clients using an alternative service can change the 203 host, port and protocol that they are using to fetch resources, but 204 these changes MUST NOT be propagated to the application that is using 205 HTTP; from that standpoint, the URI being accessed and all 206 information derived from it (scheme, host, port) are the same as 207 before. 209 Importantly, this includes its security context; in particular, when 210 TLS [RFC5246] is used to authenticate, the alternative service will 211 need to present a certificate for the origin's host name, not that of 212 the alternative. Likewise, the Host header field ([RFC7230], Section 213 5.4) is still derived from the origin, not the alternative service 214 (just as it would if a CNAME were being used). 216 The changes MAY, however, be made visible in debugging tools, 217 consoles, etc. 219 Formally, an alternative service is identified by the combination of: 221 o An Application Layer Protocol Negotiation (ALPN) protocol, as per 222 [RFC7301] 224 o A host, as per [RFC3986], Section 3.2.2 226 o A port, as per [RFC3986], Section 3.2.3 228 Additionally, each alternative service MUST have: 230 o A freshness lifetime, expressed in seconds; see Section 2.2 232 There are many ways that a client could discover the alternative 233 service(s) associated with an origin. This document describes two 234 such mechanisms: an HTTP header field (Section 3) and an HTTP/2 frame 235 type (Section 4). 237 The remainder of this section describes requirements that are common 238 to alternative services, regardless of how they are discovered. 240 2.1. Host Authentication 242 Clients MUST NOT use alternative services with a host that is 243 different than the origin's without strong server authentication; 244 this mitigates the attack described in Section 9.2. One way to 245 achieve this is for the alternative to use TLS with a certificate 246 that is valid for that origin. 248 For example, if the origin's host is "www.example.com" and an 249 alternative is offered on "other.example.com" with the "h2" protocol, 250 and the certificate offered is valid for "www.example.com", the 251 client can use the alternative. However, if "other.example.com" is 252 offered with the "h2c" protocol, the client cannot use it, because 253 there is no mechanism in that protocol to establish strong server 254 authentication. 256 2.2. Alternative Service Caching 258 Mechanisms for discovering alternative services also associate a 259 freshness lifetime with them; for example, the Alt-Svc header field 260 uses the "ma" parameter. 262 Clients MAY choose to use an alternative service instead of the 263 origin at any time when it is considered fresh; see Section 2.4 for 264 specific recommendations. 266 Clients with existing connections to an alternative service do not 267 need to stop using it when its freshness lifetime ends; i.e., the 268 caching mechanism is intended for limiting how long an alternative 269 service can be used for establishing new requests, not limiting the 270 use of existing ones. 272 Clients ought to consider that changes in network configurations can 273 result in suboptimal or compromised cached alternative services. 275 2.3. Requiring Server Name Indication 277 A client MUST only use a TLS-based alternative service if the client 278 also supports TLS Server Name Indication (SNI). This supports the 279 conservation of IP addresses on the alternative service host. 281 Note that the SNI information provided in TLS by the client will be 282 that of the origin, not the alternative (as will the Host HTTP header 283 field-value). 285 2.4. Using Alternative Services 287 By their nature, alternative services are OPTIONAL: clients do not 288 need to use them. However, it is advantageous for clients to behave 289 in a predictable way when they are used by servers (e.g., for load 290 balancing). 292 Therefore, if a client becomes aware of an alternative service, the 293 client SHOULD use that alternative service for all requests to the 294 associated origin as soon as it is available, provided that the 295 security properties of the alternative service protocol are 296 desirable, as compared to the existing connection. 298 If a client becomes aware of multiple alternative services, it MAY 299 choose the most suitable according to its own criteria (again, 300 keeping security properties in mind). For example, an origin might 301 advertise multiple alternative services to notify clients of support 302 for multiple versions of HTTP; or, an alternative service might 303 itself advertise an alternative. 305 When a client uses an alternative service for a request, it can 306 indicate this to the server using the Alt-Used header field 307 (Section 5). 309 The client does not need to block requests on any existing 310 connection; it can be used until the alternative connection is 311 established. However, if the security properties of the existing 312 connection are weak (e.g. cleartext HTTP/1.1) then it might make 313 sense to block until the new connection is fully available in order 314 to avoid information leakage. 316 Furthermore, if the connection to the alternative service fails or is 317 unresponsive, the client MAY fall back to using the origin or another 318 alternative service. Note, however, that this could be the basis of 319 a downgrade attack, thus losing any enhanced security properties of 320 the alternative service. 322 3. The Alt-Svc HTTP Header Field 324 An HTTP(S) origin server can advertise the availability of 325 alternative services to clients by adding an Alt-Svc header field to 326 responses. 328 Alt-Svc = 1#( alternative *( OWS ";" OWS parameter ) ) 329 alternative = protocol-id "=" alt-authority 330 protocol-id = token ; percent-encoded ALPN protocol identifier 331 alt-authority = quoted-string ; containing [ uri-host ] ":" port 332 parameter = token "=" ( token / quoted-string ) 334 ALPN protocol names are octet sequences with no additional 335 constraints on format. Octets not allowed in tokens ([RFC7230], 336 Section 3.2.6) MUST be percent-encoded as per Section 2.1 of 337 [RFC3986]. Consequently, the octet representing the percent 338 character "%" (hex 25) MUST be percent-encoded as well. 340 In order to have precisely one way to represent any ALPN protocol 341 name, the following additional constraints apply: 343 1. Octets in the ALPN protocol MUST NOT be percent-encoded if they 344 are valid token characters except "%", and 346 2. When using percent-encoding, uppercase hex digits MUST be used. 348 With these constraints, recipients can apply simple string comparison 349 to match protocol identifiers. 351 The "alt-authority" component consists of an OPTIONAL uri-host 352 ("host" in Section 3.2.2 of [RFC3986]), a colon (":"), and a port 353 number. 355 For example: 357 Alt-Svc: h2=":8000" 359 This indicates the "h2" protocol ([RFC7540]) on the same host using 360 the indicated port 8000. 362 An example involving a change of host: 364 Alt-Svc: h2="new.example.org:80" 366 This indicates the "h2" protocol on the host "new.example.org", 367 running on port 80. Note that the "quoted-string" syntax needs to be 368 used because ":" is not an allowed character in "token". 370 Examples for protocol name escaping: 372 +--------------------+-------------+---------------------+ 373 | ALPN protocol name | protocol-id | Note | 374 +--------------------+-------------+---------------------+ 375 | h2 | h2 | No escaping needed | 376 +--------------------+-------------+---------------------+ 377 | w=x:y#z | w%3Dx%3Ay#z | "=" and ":" escaped | 378 +--------------------+-------------+---------------------+ 379 | x%y | x%25y | "%" needs escaping | 380 +--------------------+-------------+---------------------+ 382 Alt-Svc MAY occur in any HTTP response message, regardless of the 383 status code. 385 The Alt-Svc field value can have multiple values: 387 Alt-Svc: h2c=":8000", h2=":443" 389 The value(s) advertised by Alt-Svc can be used by clients to open a 390 new connection to one or more alternative services immediately, or 391 simultaneously with subsequent requests on the same connection. 393 When using HTTP/2 ([RFC7540]), servers SHOULD instead send an ALTSVC 394 frame (Section 4). A single ALTSVC frame can be sent for a 395 connection; a new frame is not needed for every request. 397 Note that all field elements that allow "quoted-string" syntax MUST 398 be processed as per Section 3.2.6 of [RFC7230]. 400 3.1. Caching Alt-Svc Header Field Values 402 When an alternative service is advertised using Alt-Svc, it is 403 considered fresh for 24 hours from generation of the message. This 404 can be modified with the 'ma' (max-age) parameter: 406 Alt-Svc: h2=":443"; ma=3600 408 which indicates the number of seconds since the response was 409 generated the alternative service is considered fresh for. 411 ma = delta-seconds 413 See Section 4.2.3 of [RFC7234] for details of determining response 414 age. 416 For example, a response: 418 HTTP/1.1 200 OK 419 Content-Type: text/html 420 Cache-Control: 600 421 Age: 30 422 Alt-Svc: h2c=":8000"; ma=60 424 indicates that an alternative service is available and usable for the 425 next 60 seconds. However, the response has already been cached for 426 30 seconds (as per the Age header field value), so therefore the 427 alternative service is only fresh for the 30 seconds from when this 428 response was received, minus estimated transit time. 430 Note that the freshness lifetime for HTTP caching (here, 600 seconds) 431 does not affect caching of Alt-Svc values. 433 When an Alt-Svc response header field is received from an origin, its 434 value invalidates and replaces all cached alternative services for 435 that origin. 437 See Section 2.2 for general requirements on caching alternative 438 services. 440 4. The ALTSVC HTTP/2 Frame 442 The ALTSVC HTTP/2 frame ([RFC7540], Section 4) advertises the 443 availability of an alternative service to an HTTP/2 client. 445 The ALTSVC frame is a non-critical extension to HTTP/2. Endpoints 446 that do not support this frame can safely ignore it. 448 An ALTSVC frame from a server to a client on a stream other than 449 stream 0 indicates that the conveyed alternative service is 450 associated with the origin of that stream. 452 An ALTSVC frame from a server to a client on stream 0 indicates that 453 the conveyed alternative service is associated with the origin 454 contained in the Origin field of the frame. An association with an 455 origin that the client does not consider authoritative for the 456 current connection MUST be ignored. 458 The ALTSVC frame type is 0xa (decimal 10). 460 +-------------------------------+-------------------------------+ 461 | Origin-Len (16) | Origin? (*) ... 462 +-------------------------------+-------------------------------+ 463 | Alt-Svc-Field-Value (*) ... 464 +---------------------------------------------------------------+ 466 ALTSVC Frame Payload 468 The ALTSVC frame contains the following fields: 470 Origin-Len: An unsigned, 16-bit integer indicating the length, in 471 octets, of the Origin field. 473 Origin: An OPTIONAL sequence of characters containing the ASCII 474 serialization of an origin ([RFC6454], Section 6.2) that the 475 alternative service is applicable to. 477 Alt-Svc-Field-Value: A sequence of octets (length determined by 478 subtracting the length of all preceding fields from the frame 479 length) containing a value identical to the Alt-Svc field value 480 defined in Section 3 (ABNF production "Alt-Svc"). 482 The ALTSVC frame does not define any flags. 484 The ALTSVC frame is intended for receipt by clients; a server that 485 receives an ALTSVC frame MUST treat it as a connection error of type 486 PROTOCOL_ERROR. 488 An ALTSVC frame on stream 0 with empty (length 0) "Origin" 489 information is invalid and MUST be ignored. An ALTSVC frame on a 490 stream other than stream 0 containing non-empty "Origin" information 491 is invalid and MUST be ignored. 493 The ALTSVC frame is processed hop-by-hop. An intermediary MUST NOT 494 forward ALTSVC frames, though it can use the information contained in 495 ALTSVC frames in forming new ALTSVC frames to send to its own 496 clients. 498 5. The Alt-Used HTTP Header Field 500 The Alt-Used header field is used in requests to indicate the 501 identity of the alternative service in use, just as the Host header 502 field (Section 5.4 of [RFC7230]) identifies the host and port of the 503 origin. 505 Alt-Used = uri-host [ ":" port ] 507 Alt-Used is intended to allow alternative services to detect loops, 508 differentiate traffic for purposes of load balancing, and generally 509 to ensure that it is possible to identify the intended destination of 510 traffic, since introducing this information after a protocol is in 511 use has proven to be problematic. 513 When using an alternative service, clients SHOULD include a Alt-Used 514 header field in all requests. 516 As the Alt-Used header field might be used by the server for tracking 517 the client, a client MAY choose not to include it in its requests for 518 protecting its privacy (see Section 9.4). 520 For example: 522 GET /thing HTTP/1.1 523 Host: origin.example.com 524 Alt-Used: alternate.example.net 526 The extension parameters (ext-param) are reserved for future use; 527 specifications that want to define an extension will need to update 528 this document (and ought to introduce an extension registry). 530 6. The 421 Misdirected Request HTTP Status Code 532 The 421 (Misdirected Request) status code is defined in Section 9.1.2 533 of [RFC7540] to indicate that the current server instance is not 534 authoritative for the requested resource. This can be used to 535 indicate that an alternative service is not authoritative; see 536 Section 2). 538 Clients receiving 421 (Misdirected Request) from an alternative 539 service MUST remove the corresponding entry from its alternative 540 service cache (see Section 2.2) for that origin. Regardless of the 541 idempotency of the request method, they MAY retry the request, either 542 at another alternative server, or at the origin. 544 A 421 (Misdirected Request) response MAY carry an Alt-Svc header 545 field. 547 7. IANA Considerations 549 7.1. Header Field Registrations 551 HTTP header fields are registered within the "Message Headers" 552 registry maintained at 553 . 555 This document defines the following HTTP header fields, so their 556 associated registry entries shall be added according to the permanent 557 registrations below (see [BCP90]): 559 +-------------------+----------+----------+-----------+ 560 | Header Field Name | Protocol | Status | Reference | 561 +-------------------+----------+----------+-----------+ 562 | Alt-Svc | http | standard | Section 3 | 563 | Alt-Used | http | standard | Section 5 | 564 +-------------------+----------+----------+-----------+ 566 The change controller is: "IETF (iesg@ietf.org) - Internet 567 Engineering Task Force". 569 7.2. The ALTSVC HTTP/2 Frame Type 571 This document registers the ALTSVC frame type in the HTTP/2 Frame 572 Types registry ([RFC7540], Section 11.2). 574 Frame Type: ALTSVC 576 Code: 0xa 578 Specification: Section 4 of this document 580 8. Internationalization Considerations 582 An internationalized domain name that appears in either the header 583 field (Section 3) or the HTTP/2 frame (Section 4) MUST be expressed 584 using A-labels ([RFC5890], Section 2.3.2.1). 586 9. Security Considerations 588 9.1. Changing Ports 590 Using an alternative service implies accessing an origin's resources 591 on an alternative port, at a minimum. An attacker that can inject 592 alternative services and listen at the advertised port is therefore 593 able to hijack an origin. 595 For example, an attacker that can add HTTP response header fields can 596 redirect traffic to a different port on the same host using the Alt- 597 Svc header field; if that port is under the attacker's control, they 598 can thus masquerade as the HTTP server. 600 This risk can be mitigated by restricting the ability to advertise 601 alternative services, and restricting who can open a port for 602 listening on that host. 604 9.2. Changing Hosts 606 When the host is changed due to the use of an alternative service, it 607 presents an opportunity for attackers to hijack communication to an 608 origin. 610 For example, if an attacker can convince a user agent to send all 611 traffic for "innocent.example.org" to "evil.example.com" by 612 successfully associating it as an alternative service, they can 613 masquerade as that origin. This can be done locally (see mitigations 614 in Section 9.1) or remotely (e.g., by an intermediary as a man-in- 615 the-middle attack). 617 This is the reason for the requirement in Section 2.1 that any 618 alternative service with a host different to the origin's be strongly 619 authenticated with the origin's identity; i.e., presenting a 620 certificate for the origin proves that the alternative service is 621 authorized to serve traffic for the origin. 623 However, this authorization is only as strong as the method used to 624 authenticate the alternative service. In particular, there are well- 625 known exploits to make an attacker's certificate appear as 626 legitimate. 628 Alternative services could be used to persist such an attack; for 629 example, an intermediary could man-in-the-middle TLS-protected 630 communication to a target, and then direct all traffic to an 631 alternative service with a large freshness lifetime, so that the user 632 agent still directs traffic to the attacker even when not using the 633 intermediary. 635 9.3. Changing Protocols 637 When the ALPN protocol is changed due to the use of an alternative 638 service, the security properties of the new connection to the origin 639 can be different from that of the "normal" connection to the origin, 640 because the protocol identifier itself implies this. 642 For example, if a "https://" URI has a protocol advertised that does 643 not use some form of end-to-end encryption (most likely, TLS), it 644 violates the expectations for security that the URI scheme implies. 646 Therefore, clients cannot blindly use alternative services, but 647 instead evaluate the option(s) presented to assure that security 648 requirements and expectations (of specifications, implementations and 649 end users) are met. 651 9.4. Tracking Clients Using Alternative Services 653 Choosing an alternative service implies connecting to a new, server- 654 supplied host name. By using many different (potentially unique) 655 host names, servers could conceivably track client requests. 657 Clients concerned by the additional fingerprinting can choose to 658 ignore alternative service advertisements. 660 In a user agent, any alternative service information MUST be removed 661 when origin-specific data is cleared (for instance, when cookies are 662 cleared). 664 9.5. Confusion Regarding Request Scheme 666 Alternative Services MUST NOT be advertised for a protocol that is 667 not designed to carry the scheme. In particular, HTTP/1.1 over TLS 668 cannot carry safely requests for http resources. 670 10. References 672 10.1. Normative References 674 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 675 Requirement Levels", BCP 14, RFC 2119, March 1997, 676 . 678 [RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform 679 Resource Identifier (URI): Generic Syntax", STD 66, 680 RFC 3986, January 2005, 681 . 683 [RFC5234] Crocker, D. and P. Overell, "Augmented BNF for Syntax 684 Specifications: ABNF", STD 68, RFC 5234, January 2008, 685 . 687 [RFC5890] Klensin, J., "Internationalized Domain Names for 688 Applications (IDNA): Definitions and Document Framework", 689 RFC 5890, August 2010, 690 . 692 [RFC6066] Eastlake, D., "Transport Layer Security (TLS) Extensions: 693 Extension Definitions", RFC 6066, January 2011, 694 . 696 [RFC6454] Barth, A., "The Web Origin Concept", RFC 6454, 697 December 2011, . 699 [RFC7230] Fielding, R., Ed. and J. Reschke, Ed., "Hypertext Transfer 700 Protocol (HTTP/1.1): Message Syntax and Routing", 701 RFC 7230, June 2014, 702 . 704 [RFC7234] Fielding, R., Ed., Nottingham, M., Ed., and J. Reschke, 705 Ed., "Hypertext Transfer Protocol (HTTP/1.1): Caching", 706 RFC 7234, June 2014, 707 . 709 [RFC7301] Friedl, S., Popov, A., Langley, A., and S. Emile, 710 "Transport Layer Security (TLS) Application-Layer Protocol 711 Negotiation Extension", RFC 7301, July 2014, 712 . 714 [RFC7540] Belshe, M., Peon, R., and M. Thomson, Ed., "Hypertext 715 Transfer Protocol version 2", RFC 7540, May 2015, 716 . 718 10.2. Informative References 720 [BCP90] Klyne, G., Nottingham, M., and J. Mogul, "Registration 721 Procedures for Message Header Fields", BCP 90, RFC 3864, 722 September 2004, . 724 [RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security 725 (TLS) Protocol Version 1.2", RFC 5246, August 2008, 726 . 728 Appendix A. Change Log (to be removed by RFC Editor before publication) 730 A.1. Since draft-nottingham-httpbis-alt-svc-05 732 This is the first version after adoption of 733 draft-nottingham-httpbis-alt-svc-05 as Working Group work item. It 734 only contains editorial changes. 736 A.2. Since draft-ietf-httpbis-alt-svc-00 738 Selected 421 as proposed status code for "Not Authoritative". 740 Changed header field syntax to use percent-encoding of ALPN protocol 741 names (). 743 A.3. Since draft-ietf-httpbis-alt-svc-01 745 Updated HTTP/1.1 references. 747 Renamed "Service" to "Alt-Svc-Used" and reduced information to a flag 748 to address fingerprinting concerns 749 (). 751 Note that ALTSVC frame is preferred to Alt-Svc header field 752 (). 754 Incorporate ALTSRV frame 755 (). 757 Moved definition of status code 421 to HTTP/2. 759 Partly resolved . 761 A.4. Since draft-ietf-httpbis-alt-svc-02 763 Updated ALPN reference. 765 Resolved . 767 A.5. Since draft-ietf-httpbis-alt-svc-03 769 Renamed "Alt-Svc-Used" to "Alt-Used" 770 (). 772 Clarify ALTSVC Origin information requirements 773 (). 775 Remove/tune language with respect to tracking risks (see 776 ). 778 A.6. Since draft-ietf-httpbis-alt-svc-04 780 Mention tracking by alt-svc host name in Security Considerations 781 (). 783 "421 (Not Authoritative)" -> "421 (Misdirected Request)". 785 Allow the frame to carry multiple indicator and use the same payload 786 formats for both 787 (). 789 A.7. Since draft-ietf-httpbis-alt-svc-05 791 Go back to specifying the origin in Alt-Used, but make it a "SHOULD" 792 (). 794 Restore Origin field in ALT-SVC frame 795 (). 797 A.8. Since draft-ietf-httpbis-alt-svc-06 799 Disallow use of alternative services when the protocol might not 800 carry the scheme 801 (). 803 Align opp-sec and alt-svc 804 (). 806 alt svc frame on pushed (even and non-0) frame 807 (). 809 "browser" -> "user agent" 810 (). 812 ABNF for "parameter" 813 (). 815 Updated HTTP/2 reference. 817 Appendix B. Acknowledgements 819 Thanks to Adam Langley, Bence Beky, Eliot Lear, Erik Nygren, Guy 820 Podjarny, Herve Ruellan, Martin Thomson, Matthew Kerwin, Paul 821 Hoffman, Richard Barnes, Stephen Farrell, Stephen Ludin, and Will 822 Chan for their feedback and suggestions. 824 The Alt-Svc header field was influenced by the design of the 825 Alternate-Protocol header field in SPDY. 827 Authors' Addresses 829 Mark Nottingham 830 Akamai 832 EMail: mnot@mnot.net 833 URI: https://www.mnot.net/ 835 Patrick McManus 836 Mozilla 838 EMail: mcmanus@ducksong.com 839 URI: https://mozillians.org/u/pmcmanus/ 841 Julian F. Reschke 842 greenbytes GmbH 844 EMail: julian.reschke@greenbytes.de 845 URI: https://greenbytes.de/tech/webdav/