idnits 2.17.1
draft-ietf-httpbis-alt-svc-08.txt:
Checking boilerplate required by RFC 5378 and the IETF Trust (see
https://trustee.ietf.org/license-info):
----------------------------------------------------------------------------
No issues found here.
Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt:
----------------------------------------------------------------------------
No issues found here.
Checking nits according to https://www.ietf.org/id-info/checklist :
----------------------------------------------------------------------------
No issues found here.
Miscellaneous warnings:
----------------------------------------------------------------------------
== The copyright year in the IETF Trust and authors Copyright Line does not
match the current year
-- The document date (September 20, 2015) is 3141 days in the past. Is
this intentional?
Checking references for intended status: Proposed Standard
----------------------------------------------------------------------------
(See RFCs 3967 and 4897 for information about using normative references
to lower-maturity documents in RFCs)
** Obsolete normative reference: RFC 5226 (Obsoleted by RFC 8126)
** Obsolete normative reference: RFC 7230 (Obsoleted by RFC 9110, RFC 9112)
** Obsolete normative reference: RFC 7234 (Obsoleted by RFC 9111)
** Obsolete normative reference: RFC 7540 (Obsoleted by RFC 9113)
-- Obsolete informational reference (is this intentional?): RFC 5246
(Obsoleted by RFC 8446)
Summary: 4 errors (**), 0 flaws (~~), 1 warning (==), 2 comments (--).
Run idnits with the --verbose option for more detailed information about
the items above.
--------------------------------------------------------------------------------
2 HTTP Working Group M. Nottingham
3 Internet-Draft Akamai
4 Intended status: Standards Track P. McManus
5 Expires: March 23, 2016 Mozilla
6 J. Reschke
7 greenbytes
8 September 20, 2015
10 HTTP Alternative Services
11 draft-ietf-httpbis-alt-svc-08
13 Abstract
15 This document specifies "alternative services" for HTTP, which allow
16 an origin's resources to be authoritatively available at a separate
17 network location, possibly accessed with a different protocol
18 configuration.
20 Editorial Note (To be removed by RFC Editor)
22 Discussion of this draft takes place on the HTTPBIS working group
23 mailing list (ietf-http-wg@w3.org), which is archived at
24 .
26 Working Group information can be found at
27 and ;
28 source code and issues list for this draft can be found at
29 .
31 The changes in this draft are summarized in Appendix A.
33 Status of This Memo
35 This Internet-Draft is submitted in full conformance with the
36 provisions of BCP 78 and BCP 79.
38 Internet-Drafts are working documents of the Internet Engineering
39 Task Force (IETF). Note that other groups may also distribute
40 working documents as Internet-Drafts. The list of current Internet-
41 Drafts is at http://datatracker.ietf.org/drafts/current/.
43 Internet-Drafts are draft documents valid for a maximum of six months
44 and may be updated, replaced, or obsoleted by other documents at any
45 time. It is inappropriate to use Internet-Drafts as reference
46 material or to cite them other than as "work in progress."
48 This Internet-Draft will expire on March 23, 2016.
50 Copyright Notice
52 Copyright (c) 2015 IETF Trust and the persons identified as the
53 document authors. All rights reserved.
55 This document is subject to BCP 78 and the IETF Trust's Legal
56 Provisions Relating to IETF Documents
57 (http://trustee.ietf.org/license-info) in effect on the date of
58 publication of this document. Please review these documents
59 carefully, as they describe your rights and restrictions with respect
60 to this document. Code Components extracted from this document must
61 include Simplified BSD License text as described in Section 4.e of
62 the Trust Legal Provisions and are provided without warranty as
63 described in the Simplified BSD License.
65 Table of Contents
67 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4
68 1.1. Notational Conventions . . . . . . . . . . . . . . . . . . 4
69 2. Alternative Services Concepts . . . . . . . . . . . . . . . . 5
70 2.1. Host Authentication . . . . . . . . . . . . . . . . . . . 7
71 2.2. Alternative Service Caching . . . . . . . . . . . . . . . 7
72 2.3. Requiring Server Name Indication . . . . . . . . . . . . . 7
73 2.4. Using Alternative Services . . . . . . . . . . . . . . . . 8
74 3. The Alt-Svc HTTP Header Field . . . . . . . . . . . . . . . . 8
75 3.1. Caching Alt-Svc Header Field Values . . . . . . . . . . . 11
76 4. The ALTSVC HTTP/2 Frame . . . . . . . . . . . . . . . . . . . 12
77 5. The Alt-Used HTTP Header Field . . . . . . . . . . . . . . . . 13
78 6. The 421 Misdirected Request HTTP Status Code . . . . . . . . . 14
79 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 14
80 7.1. Header Field Registrations . . . . . . . . . . . . . . . . 14
81 7.2. The ALTSVC HTTP/2 Frame Type . . . . . . . . . . . . . . . 15
82 7.3. Alt-Svc Parameter Registry . . . . . . . . . . . . . . . . 15
83 7.3.1. Procedure . . . . . . . . . . . . . . . . . . . . . . 15
84 7.3.2. Registrations . . . . . . . . . . . . . . . . . . . . 15
85 8. Internationalization Considerations . . . . . . . . . . . . . 15
86 9. Security Considerations . . . . . . . . . . . . . . . . . . . 16
87 9.1. Changing Ports . . . . . . . . . . . . . . . . . . . . . . 16
88 9.2. Changing Hosts . . . . . . . . . . . . . . . . . . . . . . 16
89 9.3. Changing Protocols . . . . . . . . . . . . . . . . . . . . 17
90 9.4. Tracking Clients Using Alternative Services . . . . . . . 17
91 9.5. Confusion Regarding Request Scheme . . . . . . . . . . . . 17
92 10. References . . . . . . . . . . . . . . . . . . . . . . . . . . 17
93 10.1. Normative References . . . . . . . . . . . . . . . . . . . 17
94 10.2. Informative References . . . . . . . . . . . . . . . . . . 19
95 Appendix A. Change Log (to be removed by RFC Editor before
96 publication) . . . . . . . . . . . . . . . . . . . . 19
97 A.1. Since draft-nottingham-httpbis-alt-svc-05 . . . . . . . . 19
98 A.2. Since draft-ietf-httpbis-alt-svc-00 . . . . . . . . . . . 19
99 A.3. Since draft-ietf-httpbis-alt-svc-01 . . . . . . . . . . . 19
100 A.4. Since draft-ietf-httpbis-alt-svc-02 . . . . . . . . . . . 19
101 A.5. Since draft-ietf-httpbis-alt-svc-03 . . . . . . . . . . . 20
102 A.6. Since draft-ietf-httpbis-alt-svc-04 . . . . . . . . . . . 20
103 A.7. Since draft-ietf-httpbis-alt-svc-05 . . . . . . . . . . . 20
104 A.8. Since draft-ietf-httpbis-alt-svc-06 . . . . . . . . . . . 20
105 A.9. Since draft-ietf-httpbis-alt-svc-07 . . . . . . . . . . . 21
106 Appendix B. Acknowledgements . . . . . . . . . . . . . . . . . . 21
108 1. Introduction
110 HTTP [RFC7230] conflates the identification of resources with their
111 location. In other words, "http://" (and "https://") URLs are used
112 to both name and find things to interact with.
114 In some cases, it is desirable to separate identification and
115 location in HTTP; keeping the same identifier for a resource, but
116 interacting with it at a different location on the network.
118 For example:
120 o An origin server might wish to redirect a client to a different
121 server when it is under load, or it has found a server in a
122 location that is more local to the client.
124 o An origin server might wish to offer access to its resources using
125 a new protocol (such as HTTP/2, see [RFC7540]) or one using
126 improved security (such as Transport Layer Security (TLS), see
127 [RFC5246]).
129 o An origin server might wish to segment its clients into groups of
130 capabilities, such as those supporting Server Name Indication
131 (SNI, see Section 3 of [RFC6066]) and those not supporting it, for
132 operational purposes.
134 This specification defines a new concept in HTTP, "Alternative
135 Services", that allows an origin server to nominate additional means
136 of interacting with it on the network. It defines a general
137 framework for this in Section 2, along with specific mechanisms for
138 advertising their existence using HTTP header fields (Section 3) or
139 HTTP/2 frames (Section 4), plus a way to indicate that an alternative
140 service was used (Section 5).
142 It also endorses the status code 421 (Misdirected Request)
143 (Section 6) that origin servers (or their nominated alternatives) can
144 use to indicate that they are not authoritative for a given origin,
145 in cases where the wrong location is used.
147 1.1. Notational Conventions
149 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
150 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
151 document are to be interpreted as described in [RFC2119].
153 This document uses the Augmented BNF defined in [RFC5234] along with
154 the "#rule" extension defined in Section 7 of [RFC7230]. The rules
155 below are defined in [RFC5234], [RFC7230], and [RFC7234]:
157 DIGIT =
158 OWS =
159 delta-seconds =
160 port =
161 quoted-string =
162 token =
163 uri-host =
165 2. Alternative Services Concepts
167 This specification defines a new concept in HTTP, the "alternative
168 service". When an origin (see [RFC6454]) has resources that are
169 accessible through a different protocol / host / port combination, it
170 is said to have an alternative service available.
172 An alternative service can be used to interact with the resources on
173 an origin server at a separate location on the network, possibly
174 using a different protocol configuration. Alternative services are
175 considered authoritative for an origin's resources, in the sense of
176 [RFC7230], Section 9.1.
178 For example, an origin:
180 ("http", "www.example.com", "80")
182 might declare that its resources are also accessible at the
183 alternative service:
185 ("h2", "new.example.com", "81")
187 By their nature, alternative services are explicitly at the
188 granularity of an origin; i.e., they cannot be selectively applied to
189 resources within an origin.
191 Alternative services do not replace or change the origin for any
192 given resource; in general, they are not visible to the software
193 "above" the access mechanism. The alternative service is essentially
194 alternative routing information that can also be used to reach the
195 origin in the same way that DNS CNAME or SRV records define routing
196 information at the name resolution level. Each origin maps to a set
197 of these routes -- the default route is derived from thr origin
198 itself and the other routes are introduced based on alternative-
199 protocol information.
201 Furthermore, it is important to note that the first member of an
202 alternative service tuple is different from the "scheme" component of
203 an origin; it is more specific, identifying not only the major
204 version of the protocol being used, but potentially communication
205 options for that protocol.
207 This means that clients using an alternative service can change the
208 host, port and protocol that they are using to fetch resources, but
209 these changes MUST NOT be propagated to the application that is using
210 HTTP; from that standpoint, the URI being accessed and all
211 information derived from it (scheme, host, port) are the same as
212 before.
214 Importantly, this includes its security context; in particular, when
215 TLS [RFC5246] is used to authenticate, the alternative service will
216 need to present a certificate for the origin's host name, not that of
217 the alternative. Likewise, the Host header field ([RFC7230], Section
218 5.4) is still derived from the origin, not the alternative service
219 (just as it would if a CNAME were being used).
221 The changes MAY, however, be made visible in debugging tools,
222 consoles, etc.
224 Formally, an alternative service is identified by the combination of:
226 o An Application Layer Protocol Negotiation (ALPN) protocol name, as
227 per [RFC7301]
229 o A host, as per [RFC3986], Section 3.2.2
231 o A port, as per [RFC3986], Section 3.2.3
233 The ALPN protocol name is used to identify the application protocol
234 or suite of protocols used by the alternative service. Note that for
235 the purpose of this specification, an ALPN protocol name implicitly
236 includes TLS in the suite of protocols it identifies, unless
237 specified otherwise in its definition. In particular, the ALPN name
238 "http/1.1", registered by Section 6 of [RFC7301], identifies HTTP/1.1
239 over TLS.
241 Additionally, each alternative service MUST have:
243 o A freshness lifetime, expressed in seconds; see Section 2.2
245 There are many ways that a client could discover the alternative
246 service(s) associated with an origin. This document describes two
247 such mechanisms: an HTTP header field (Section 3) and an HTTP/2 frame
248 type (Section 4).
250 The remainder of this section describes requirements that are common
251 to alternative services, regardless of how they are discovered.
253 2.1. Host Authentication
255 Clients MUST NOT use alternative services with a host that is
256 different than the origin's without strong server authentication;
257 this mitigates the attack described in Section 9.2. One way to
258 achieve this is for the alternative to use TLS with a certificate
259 that is valid for that origin.
261 For example, if the origin's host is "www.example.com" and an
262 alternative is offered on "other.example.com" with the "h2" protocol,
263 and the certificate offered is valid for "www.example.com", the
264 client can use the alternative. However, if "other.example.com" is
265 offered with the "h2c" protocol, the client cannot use it, because
266 there is no mechanism in that protocol to establish strong server
267 authentication.
269 2.2. Alternative Service Caching
271 Mechanisms for discovering alternative services also associate a
272 freshness lifetime with them; for example, the Alt-Svc header field
273 uses the "ma" parameter.
275 Clients MAY choose to use an alternative service instead of the
276 origin at any time when it is considered fresh; see Section 2.4 for
277 specific recommendations.
279 Clients with existing connections to an alternative service do not
280 need to stop using it when its freshness lifetime ends; i.e., the
281 caching mechanism is intended for limiting how long an alternative
282 service can be used for establishing new connections, not limiting
283 the use of existing ones.
285 When alternative services are used to send a client to the most
286 optimal server, a change in network configuration can result in
287 cached values becoming suboptimal. Therefore, clients SHOULD remove
288 from cache all alternative services that lack the "persist" flag with
289 the value "1" when they detect such a change (when information about
290 network state is available).
292 2.3. Requiring Server Name Indication
294 A client MUST only use a TLS-based alternative service if the client
295 also supports TLS Server Name Indication (SNI). This supports the
296 conservation of IP addresses on the alternative service host.
298 Note that the SNI information provided in TLS by the client will be
299 that of the origin, not the alternative (as will the Host HTTP header
300 field-value).
302 2.4. Using Alternative Services
304 By their nature, alternative services are OPTIONAL: clients do not
305 need to use them. However, it is advantageous for clients to behave
306 in a predictable way when they are used by servers (e.g., for load
307 balancing).
309 Therefore, if a client becomes aware of an alternative service, the
310 client SHOULD use that alternative service for all requests to the
311 associated origin as soon as it is available, provided that the
312 security properties of the alternative service protocol are
313 desirable, as compared to the existing connection.
315 If a client becomes aware of multiple alternative services, it MAY
316 choose the most suitable according to its own criteria (again,
317 keeping security properties in mind). For example, an origin might
318 advertise multiple alternative services to notify clients of support
319 for multiple versions of HTTP; or, an alternative service might
320 itself advertise an alternative.
322 A client configured to use a proxy for a given request SHOULD NOT
323 directly connect to an alternative service for it, but instead route
324 it through that proxy.
326 When a client uses an alternative service for a request, it can
327 indicate this to the server using the Alt-Used header field
328 (Section 5).
330 The client does not need to block requests on any existing
331 connection; it can be used until the alternative connection is
332 established. However, if the security properties of the existing
333 connection are weak (e.g. cleartext HTTP/1.1) then it might make
334 sense to block until the new connection is fully available in order
335 to avoid information leakage.
337 Furthermore, if the connection to the alternative service fails or is
338 unresponsive, the client MAY fall back to using the origin or another
339 alternative service. Note, however, that this could be the basis of
340 a downgrade attack, thus losing any enhanced security properties of
341 the alternative service.
343 3. The Alt-Svc HTTP Header Field
345 An HTTP(S) origin server can advertise the availability of
346 alternative services to clients by adding an Alt-Svc header field to
347 responses.
349 Alt-Svc = clear / 1#alt-value
350 clear = %x63.6C.65.61.72; "clear", case-sensitive
351 alt-value = alternative *( OWS ";" OWS parameter )
352 alternative = protocol-id "=" alt-authority
353 protocol-id = token ; percent-encoded ALPN protocol name
354 alt-authority = quoted-string ; containing [ uri-host ] ":" port
355 parameter = token "=" ( token / quoted-string )
357 The field value consists either of a list of values, each of which
358 indicating one alternative service, or the keyword "clear".
360 A field value containing the special value "clear" indicates that the
361 origin requests all alternatives for that origin to be invalidated
362 (including those specified in the same response, in case of an
363 invalid reply containing both "clear" and alternative services).
365 ALPN protocol names are octet sequences with no additional
366 constraints on format. Octets not allowed in tokens ([RFC7230],
367 Section 3.2.6) MUST be percent-encoded as per Section 2.1 of
368 [RFC3986]. Consequently, the octet representing the percent
369 character "%" (hex 25) MUST be percent-encoded as well.
371 In order to have precisely one way to represent any ALPN protocol
372 name, the following additional constraints apply:
374 1. Octets in the ALPN protocol name MUST NOT be percent-encoded if
375 they are valid token characters except "%", and
377 2. When using percent-encoding, uppercase hex digits MUST be used.
379 With these constraints, recipients can apply simple string comparison
380 to match protocol identifiers.
382 The "alt-authority" component consists of an OPTIONAL uri-host
383 ("host" in Section 3.2.2 of [RFC3986]), a colon (":"), and a port
384 number.
386 For example:
388 Alt-Svc: h2=":8000"
390 This indicates the "h2" protocol ([RFC7540]) on the same host using
391 the indicated port 8000.
393 An example involving a change of host:
395 Alt-Svc: h2="new.example.org:80"
397 This indicates the "h2" protocol on the host "new.example.org",
398 running on port 80. Note that the "quoted-string" syntax needs to be
399 used because ":" is not an allowed character in "token".
401 Examples for protocol name escaping:
403 +--------------------+-------------+---------------------+
404 | ALPN protocol name | protocol-id | Note |
405 +--------------------+-------------+---------------------+
406 | h2 | h2 | No escaping needed |
407 +--------------------+-------------+---------------------+
408 | w=x:y#z | w%3Dx%3Ay#z | "=" and ":" escaped |
409 +--------------------+-------------+---------------------+
410 | x%y | x%25y | "%" needs escaping |
411 +--------------------+-------------+---------------------+
413 Alt-Svc MAY occur in any HTTP response message, regardless of the
414 status code. Note that recipients of Alt-Svc are free to ignore the
415 header field (and indeed need to in some situations; see Sections 2.1
416 and 6).
418 The Alt-Svc field value can have multiple values:
420 Alt-Svc: h2c=":8000", h2=":443"
422 When multiple values are present, the order of the values reflects
423 the server's preference (with the first value being the most
424 preferred alternative).
426 The value(s) advertised by Alt-Svc can be used by clients to open a
427 new connection to an alternative service. Subsequent requests can
428 start using this new connection immediately, or can continue using
429 the existing connection while the new connection is created.
431 When using HTTP/2 ([RFC7540]), servers SHOULD instead send an ALTSVC
432 frame (Section 4). A single ALTSVC frame can be sent for a
433 connection; a new frame is not needed for every request. Note that,
434 despite this recommendation, Alt-Svc header fields remain valid in
435 responses delivered over HTTP/2.
437 This specification defines two parameters: "ma" and "persist",
438 defined in Section 3.1. Unknown parameters MUST be ignored, that is
439 the values (alt-value) they appear in MUST be processed as if the
440 unknown parameter was not present.
442 New parameters can be defined in extension specifications (see
443 Section 7.3 for registration details).
445 Note that all field elements that allow "quoted-string" syntax MUST
446 be processed as per Section 3.2.6 of [RFC7230].
448 3.1. Caching Alt-Svc Header Field Values
450 When an alternative service is advertised using Alt-Svc, it is
451 considered fresh for 24 hours from generation of the message. This
452 can be modified with the 'ma' (max-age) parameter:
454 Alt-Svc: h2=":443"; ma=3600
456 which indicates the number of seconds since the response was
457 generated the alternative service is considered fresh for.
459 ma = delta-seconds
461 See Section 4.2.3 of [RFC7234] for details of determining response
462 age.
464 For example, a response:
466 HTTP/1.1 200 OK
467 Content-Type: text/html
468 Cache-Control: 600
469 Age: 30
470 Alt-Svc: h2c=":8000"; ma=60
472 indicates that an alternative service is available and usable for the
473 next 60 seconds. However, the response has already been cached for
474 30 seconds (as per the Age header field value), so therefore the
475 alternative service is only fresh for the 30 seconds from when this
476 response was received, minus estimated transit time.
478 Note that the freshness lifetime for HTTP caching (here, 600 seconds)
479 does not affect caching of Alt-Svc values.
481 When an Alt-Svc response header field is received from an origin, its
482 value invalidates and replaces all cached alternative services for
483 that origin.
485 By default, cached alternative services will be cleared when the
486 client detects a network change. Alternative services that are
487 intended to be longer-lived (e.g., those that are not specific to the
488 client access network) can carry the "persist" parameter with a value
489 "1" as a hint that the service is potentially useful beyond a network
490 configuration change.
492 persist = 1DIGIT
494 For example:
496 Alt-Svc: h2=":443"; ma=2592000; persist=1
498 This specification only a defines a single value for "persist";
499 others can be defined in future specifications. Clients MUST ignore
500 "persist" parameters with unknown values.
502 See Section 2.2 for general requirements on caching alternative
503 services.
505 4. The ALTSVC HTTP/2 Frame
507 The ALTSVC HTTP/2 frame ([RFC7540], Section 4) advertises the
508 availability of an alternative service to an HTTP/2 client.
510 The ALTSVC frame is a non-critical extension to HTTP/2. Endpoints
511 that do not support this frame can safely ignore it.
513 An ALTSVC frame from a server to a client on a stream other than
514 stream 0 indicates that the conveyed alternative service is
515 associated with the origin of that stream.
517 An ALTSVC frame from a server to a client on stream 0 indicates that
518 the conveyed alternative service is associated with the origin
519 contained in the Origin field of the frame. An association with an
520 origin that the client does not consider authoritative for the
521 current connection MUST be ignored.
523 The ALTSVC frame type is 0xa (decimal 10).
525 +-------------------------------+-------------------------------+
526 | Origin-Len (16) | Origin? (*) ...
527 +-------------------------------+-------------------------------+
528 | Alt-Svc-Field-Value (*) ...
529 +---------------------------------------------------------------+
531 ALTSVC Frame Payload
533 The ALTSVC frame contains the following fields:
535 Origin-Len: An unsigned, 16-bit integer indicating the length, in
536 octets, of the Origin field.
538 Origin: An OPTIONAL sequence of characters containing the ASCII
539 serialization of an origin ([RFC6454], Section 6.2) that the
540 alternative service is applicable to.
542 Alt-Svc-Field-Value: A sequence of octets (length determined by
543 subtracting the length of all preceding fields from the frame
544 length) containing a value identical to the Alt-Svc field value
545 defined in Section 3 (ABNF production "Alt-Svc").
547 The ALTSVC frame does not define any flags.
549 The ALTSVC frame is intended for receipt by clients; a server that
550 receives an ALTSVC frame can safely ignore it.
552 An ALTSVC frame on stream 0 with empty (length 0) "Origin"
553 information is invalid and MUST be ignored. An ALTSVC frame on a
554 stream other than stream 0 containing non-empty "Origin" information
555 is invalid and MUST be ignored.
557 The ALTSVC frame is processed hop-by-hop. An intermediary MUST NOT
558 forward ALTSVC frames, though it can use the information contained in
559 ALTSVC frames in forming new ALTSVC frames to send to its own
560 clients.
562 5. The Alt-Used HTTP Header Field
564 The Alt-Used header field is used in requests to indicate the
565 identity of the alternative service in use, just as the Host header
566 field (Section 5.4 of [RFC7230]) identifies the host and port of the
567 origin.
569 Alt-Used = uri-host [ ":" port ]
571 Alt-Used is intended to allow alternative services to detect loops,
572 differentiate traffic for purposes of load balancing, and generally
573 to ensure that it is possible to identify the intended destination of
574 traffic, since introducing this information after a protocol is in
575 use has proven to be problematic.
577 When using an alternative service, clients SHOULD include a Alt-Used
578 header field in all requests.
580 As the Alt-Used header field might be used by the server for tracking
581 the client, a client MAY choose not to include it in its requests for
582 protecting its privacy (see Section 9.4).
584 For example:
586 GET /thing HTTP/1.1
587 Host: origin.example.com
588 Alt-Used: alternate.example.net
590 The extension parameters (ext-param) are reserved for future use;
591 specifications that want to define an extension will need to update
592 this document (and ought to introduce an extension registry).
594 6. The 421 Misdirected Request HTTP Status Code
596 The 421 (Misdirected Request) status code is defined in Section 9.1.2
597 of [RFC7540] to indicate that the current server instance is not
598 authoritative for the requested resource. This can be used to
599 indicate that an alternative service is not authoritative; see
600 Section 2).
602 Clients receiving 421 (Misdirected Request) from an alternative
603 service MUST remove the corresponding entry from its alternative
604 service cache (see Section 2.2) for that origin. Regardless of the
605 idempotency of the request method, they MAY retry the request, either
606 at another alternative server, or at the origin.
608 An Alt-Svc header field in a 421 (Misdirected Request) response MUST
609 be ignored.
611 7. IANA Considerations
613 7.1. Header Field Registrations
615 HTTP header fields are registered within the "Message Headers"
616 registry maintained at
617 .
619 This document defines the following HTTP header fields, so their
620 associated registry entries shall be added according to the permanent
621 registrations below (see [BCP90]):
623 +-------------------+----------+----------+-----------+
624 | Header Field Name | Protocol | Status | Reference |
625 +-------------------+----------+----------+-----------+
626 | Alt-Svc | http | standard | Section 3 |
627 | Alt-Used | http | standard | Section 5 |
628 +-------------------+----------+----------+-----------+
630 The change controller is: "IETF (iesg@ietf.org) - Internet
631 Engineering Task Force".
633 7.2. The ALTSVC HTTP/2 Frame Type
635 This document registers the ALTSVC frame type in the HTTP/2 Frame
636 Types registry ([RFC7540], Section 11.2).
638 Frame Type: ALTSVC
640 Code: 0xa
642 Specification: Section 4 of this document
644 7.3. Alt-Svc Parameter Registry
646 The HTTP Alt-Svc Parameter Registry defines the name space for the
647 cache directives. It will be created and maintained at (the
648 suggested URI)
649 .
651 7.3.1. Procedure
653 A registration MUST include the following fields:
655 o Parameter Name
657 o Pointer to specification text
659 Values to be added to this name space require IETF Review (see
660 [RFC5226], Section 4.1).
662 7.3.2. Registrations
664 The HTTP Alt-Svc Parameter Registry is to be populated with the
665 registrations below:
667 +-------------------+-------------+
668 | Alt-Svc Parameter | Reference |
669 +-------------------+-------------+
670 | ma | Section 3.1 |
671 | persist | Section 3.1 |
672 +-------------------+-------------+
674 8. Internationalization Considerations
676 An internationalized domain name that appears in either the header
677 field (Section 3) or the HTTP/2 frame (Section 4) MUST be expressed
678 using A-labels ([RFC5890], Section 2.3.2.1).
680 9. Security Considerations
682 9.1. Changing Ports
684 Using an alternative service implies accessing an origin's resources
685 on an alternative port, at a minimum. An attacker that can inject
686 alternative services and listen at the advertised port is therefore
687 able to hijack an origin.
689 For example, an attacker that can add HTTP response header fields can
690 redirect traffic to a different port on the same host using the Alt-
691 Svc header field; if that port is under the attacker's control, they
692 can thus masquerade as the HTTP server.
694 This risk can be mitigated by restricting the ability to advertise
695 alternative services, and restricting who can open a port for
696 listening on that host.
698 9.2. Changing Hosts
700 When the host is changed due to the use of an alternative service, it
701 presents an opportunity for attackers to hijack communication to an
702 origin.
704 For example, if an attacker can convince a user agent to send all
705 traffic for "innocent.example.org" to "evil.example.com" by
706 successfully associating it as an alternative service, they can
707 masquerade as that origin. This can be done locally (see mitigations
708 in Section 9.1) or remotely (e.g., by an intermediary as a man-in-
709 the-middle attack).
711 This is the reason for the requirement in Section 2.1 that any
712 alternative service with a host different to the origin's be strongly
713 authenticated with the origin's identity; i.e., presenting a
714 certificate for the origin proves that the alternative service is
715 authorized to serve traffic for the origin.
717 However, this authorization is only as strong as the method used to
718 authenticate the alternative service. In particular, there are well-
719 known exploits to make an attacker's certificate appear as
720 legitimate.
722 Alternative services could be used to persist such an attack; for
723 example, an intermediary could man-in-the-middle TLS-protected
724 communication to a target, and then direct all traffic to an
725 alternative service with a large freshness lifetime, so that the user
726 agent still directs traffic to the attacker even when not using the
727 intermediary.
729 9.3. Changing Protocols
731 When the ALPN protocol is changed due to the use of an alternative
732 service, the security properties of the new connection to the origin
733 can be different from that of the "normal" connection to the origin,
734 because the protocol identifier itself implies this.
736 For example, if a "https://" URI has a protocol advertised that does
737 not use some form of end-to-end encryption (most likely, TLS), it
738 violates the expectations for security that the URI scheme implies.
740 Therefore, clients cannot blindly use alternative services, but
741 instead evaluate the option(s) presented to assure that security
742 requirements and expectations (of specifications, implementations and
743 end users) are met.
745 9.4. Tracking Clients Using Alternative Services
747 Choosing an alternative service implies connecting to a new, server-
748 supplied host name. By using many different (potentially unique)
749 host names, servers could conceivably track client requests. Such
750 tracking could follow users across multiple networks, when the
751 "persist" flag is used.
753 Clients concerned by the additional fingerprinting can choose to
754 ignore alternative service advertisements.
756 In a user agent, any alternative service information MUST be removed
757 when origin-specific data is cleared (for instance, when cookies are
758 cleared).
760 9.5. Confusion Regarding Request Scheme
762 Alternative Services MUST NOT be advertised for a protocol that is
763 not designed to carry the scheme. In particular, HTTP/1.1 over TLS
764 cannot safely carry requests for http resources.
766 10. References
768 10.1. Normative References
770 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
771 Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/
772 RFC2119, March 1997,
773 .
775 [RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform
776 Resource Identifier (URI): Generic Syntax", STD 66,
777 RFC 3986, DOI 10.17487/RFC3986, January 2005,
778 .
780 [RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an
781 IANA Considerations Section in RFCs", BCP 26, RFC 5226,
782 DOI 10.17487/RFC5226, May 2008,
783 .
785 [RFC5234] Crocker, D. and P. Overell, "Augmented BNF for Syntax
786 Specifications: ABNF", STD 68, RFC 5234, DOI 10.17487/
787 RFC5234, January 2008,
788 .
790 [RFC5890] Klensin, J., "Internationalized Domain Names for
791 Applications (IDNA): Definitions and Document Framework",
792 RFC 5890, DOI 10.17487/RFC5890, August 2010,
793 .
795 [RFC6066] Eastlake, D., "Transport Layer Security (TLS) Extensions:
796 Extension Definitions", RFC 6066, DOI 10.17487/RFC6066,
797 January 2011, .
799 [RFC6454] Barth, A., "The Web Origin Concept", RFC 6454,
800 DOI 10.17487/RFC6454, December 2011,
801 .
803 [RFC7230] Fielding, R., Ed. and J. Reschke, Ed., "Hypertext Transfer
804 Protocol (HTTP/1.1): Message Syntax and Routing",
805 RFC 7230, DOI 10.17487/RFC7230, June 2014,
806 .
808 [RFC7234] Fielding, R., Ed., Nottingham, M., Ed., and J. Reschke,
809 Ed., "Hypertext Transfer Protocol (HTTP/1.1): Caching",
810 RFC 7234, DOI 10.17487/RFC7234, June 2014,
811 .
813 [RFC7301] Friedl, S., Popov, A., Langley, A., and S. Emile,
814 "Transport Layer Security (TLS) Application-Layer Protocol
815 Negotiation Extension", RFC 7301, DOI 10.17487/RFC7301,
816 July 2014, .
818 [RFC7540] Belshe, M., Peon, R., and M. Thomson, Ed., "Hypertext
819 Transfer Protocol version 2", RFC 7540, DOI 10.17487/
820 RFC7540, May 2015,
821 .
823 10.2. Informative References
825 [BCP90] Klyne, G., Nottingham, M., and J. Mogul, "Registration
826 Procedures for Message Header Fields", BCP 90, RFC 3864,
827 September 2004, .
829 [RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security
830 (TLS) Protocol Version 1.2", RFC 5246, DOI 10.17487/
831 RFC5246, August 2008,
832 .
834 Appendix A. Change Log (to be removed by RFC Editor before publication)
836 A.1. Since draft-nottingham-httpbis-alt-svc-05
838 This is the first version after adoption of
839 draft-nottingham-httpbis-alt-svc-05 as Working Group work item. It
840 only contains editorial changes.
842 A.2. Since draft-ietf-httpbis-alt-svc-00
844 Selected 421 as proposed status code for "Not Authoritative".
846 Changed header field syntax to use percent-encoding of ALPN protocol
847 names ().
849 A.3. Since draft-ietf-httpbis-alt-svc-01
851 Updated HTTP/1.1 references.
853 Renamed "Service" to "Alt-Svc-Used" and reduced information to a flag
854 to address fingerprinting concerns
855 ().
857 Note that ALTSVC frame is preferred to Alt-Svc header field
858 ().
860 Incorporate ALTSRV frame
861 ().
863 Moved definition of status code 421 to HTTP/2.
865 Partly resolved .
867 A.4. Since draft-ietf-httpbis-alt-svc-02
869 Updated ALPN reference.
871 Resolved .
873 A.5. Since draft-ietf-httpbis-alt-svc-03
875 Renamed "Alt-Svc-Used" to "Alt-Used"
876 ().
878 Clarify ALTSVC Origin information requirements
879 ().
881 Remove/tune language with respect to tracking risks (see
882 ).
884 A.6. Since draft-ietf-httpbis-alt-svc-04
886 Mention tracking by alt-svc host name in Security Considerations
887 ().
889 "421 (Not Authoritative)" -> "421 (Misdirected Request)".
891 Allow the frame to carry multiple indicator and use the same payload
892 formats for both
893 ().
895 A.7. Since draft-ietf-httpbis-alt-svc-05
897 Go back to specifying the origin in Alt-Used, but make it a "SHOULD"
898 ().
900 Restore Origin field in ALT-SVC frame
901 ().
903 A.8. Since draft-ietf-httpbis-alt-svc-06
905 Disallow use of alternative services when the protocol might not
906 carry the scheme
907 ().
909 Align opp-sec and alt-svc
910 ().
912 alt svc frame on pushed (even and non-0) frame
913 ().
915 "browser" -> "user agent"
916 ().
918 ABNF for "parameter"
919 ().
921 Updated HTTP/2 reference.
923 A.9. Since draft-ietf-httpbis-alt-svc-07
925 Alt-Svc alternative cache invalidation
926 ().
928 Unexpected Alt-Svc frames
929 ().
931 Associating Alt-Svc header with an origin
932 ().
934 ALPN identifiers in Alt-Svc
935 ().
937 Number of alternate services used
938 ().
940 Proxy and .pac interaction
941 ().
943 Need to define extensibility for alt-svc parameters
944 ().
946 Persistence of alternates across network changes
947 ().
949 Alt-Svc header with 421 status
950 ().
952 Incorporate several editorial improvements suggested by Mike Bishop
953 (,
954 ).
956 Alt-Svc response header field in HTTP/2 frame
957 ().
959 Appendix B. Acknowledgements
961 Thanks to Adam Langley, Bence Beky, Eliot Lear, Erik Nygren, Guy
962 Podjarny, Herve Ruellan, Martin Thomson, Matthew Kerwin, Mike Bishop,
963 Paul Hoffman, Richard Barnes, Stephen Farrell, Stephen Ludin, and
964 Will Chan for their feedback and suggestions.
966 The Alt-Svc header field was influenced by the design of the
967 Alternate-Protocol header field in SPDY.
969 Authors' Addresses
971 Mark Nottingham
972 Akamai
974 EMail: mnot@mnot.net
975 URI: https://www.mnot.net/
977 Patrick McManus
978 Mozilla
980 EMail: mcmanus@ducksong.com
981 URI: https://mozillians.org/u/pmcmanus/
983 Julian F. Reschke
984 greenbytes GmbH
986 EMail: julian.reschke@greenbytes.de
987 URI: https://greenbytes.de/tech/webdav/