idnits 2.17.1 draft-sharhalakis-httptz-05.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- ** The document seems to lack a License Notice according IETF Trust Provisions of 28 Dec 2009, Section 6.b.ii or Provisions of 12 Sep 2009 Section 6.b -- however, there's a paragraph with a matching beginning. Boilerplate error? (You're using the IETF Trust Provisions' Section 6.b License Notice from 12 Feb 2009 rather than one of the newer Notices. See https://trustee.ietf.org/license-info/.) Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document seems to lack a disclaimer for pre-RFC5378 work, but may have content which was first submitted before 10 November 2008. If you have contacted all the original authors and they are all willing to grant the BCP78 rights to the IETF Trust, then this is fine, and you can ignore this comment. If not, you may need to add the pre-RFC5378 disclaimer. (See the Legal Provisions document at https://trustee.ietf.org/license-info for more information.) -- The document date (July 27, 2009) is 5386 days in the past. Is this intentional? Checking references for intended status: Experimental ---------------------------------------------------------------------------- == Unused Reference: 'I-D.rfc-editor-rfc2223bis' is defined on line 359, but no explicit reference was found in the text ** Obsolete normative reference: RFC 2616 (Obsoleted by RFC 7230, RFC 7231, RFC 7232, RFC 7233, RFC 7234, RFC 7235) Summary: 2 errors (**), 0 flaws (~~), 2 warnings (==), 2 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Network Working Group S. Harhalakis 3 Internet-Draft TEI of Thessaloniki 4 Intended status: Experimental July 27, 2009 5 Expires: January 28, 2010 7 Timezone Information in HTTP 8 draft-sharhalakis-httptz-05.txt 10 Status of this Memo 12 This Internet-Draft is submitted to IETF in full conformance with the 13 provisions of BCP 78 and BCP 79. 15 Internet-Drafts are working documents of the Internet Engineering 16 Task Force (IETF), its areas, and its working groups. Note that 17 other groups may also distribute working documents as Internet- 18 Drafts. 20 Internet-Drafts are draft documents valid for a maximum of six months 21 and may be updated, replaced, or obsoleted by other documents at any 22 time. It is inappropriate to use Internet-Drafts as reference 23 material or to cite them other than as "work in progress." 25 The list of current Internet-Drafts can be accessed at 26 http://www.ietf.org/ietf/1id-abstracts.txt. 28 The list of Internet-Draft Shadow Directories can be accessed at 29 http://www.ietf.org/shadow.html. 31 This Internet-Draft will expire on January 28, 2010. 33 Copyright Notice 35 Copyright (c) 2009 IETF Trust and the persons identified as the 36 document authors. All rights reserved. 38 This document is subject to BCP 78 and the IETF Trust's Legal 39 Provisions Relating to IETF Documents in effect on the date of 40 publication of this document (http://trustee.ietf.org/license-info). 41 Please review these documents carefully, as they describe your rights 42 and restrictions with respect to this document. 44 Abstract 46 This document defines a HTTP header for clients to provide timezone 47 information to web servers. An ABNF description of the corresponding 48 header is provided. 50 Discussion 52 Discussion about this document takes place in http-wg mailing list 53 (ietf-http-wg@w3.org). Please CC v13@v13.gr too. 55 Table of Contents 57 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4 58 1.1. Purpose . . . . . . . . . . . . . . . . . . . . . . . . . 4 59 1.2. Requirements . . . . . . . . . . . . . . . . . . . . . . . 4 60 1.3. Terminology . . . . . . . . . . . . . . . . . . . . . . . 4 61 1.4. Considerations . . . . . . . . . . . . . . . . . . . . . . 5 62 2. Definition . . . . . . . . . . . . . . . . . . . . . . . . . . 7 63 2.1. Client support . . . . . . . . . . . . . . . . . . . . . . 7 64 2.2. Server support . . . . . . . . . . . . . . . . . . . . . . 8 65 2.3. Proxy considerations . . . . . . . . . . . . . . . . . . . 8 66 3. Security Considerations . . . . . . . . . . . . . . . . . . . 9 67 3.1. Client side . . . . . . . . . . . . . . . . . . . . . . . 9 68 3.2. Server side . . . . . . . . . . . . . . . . . . . . . . . 9 69 4. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 10 70 5. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 11 71 6. References . . . . . . . . . . . . . . . . . . . . . . . . . . 12 72 6.1. Normative . . . . . . . . . . . . . . . . . . . . . . . . 12 73 6.2. Informative . . . . . . . . . . . . . . . . . . . . . . . 12 74 Appendix A. Examples . . . . . . . . . . . . . . . . . . . . . . 13 75 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 14 77 1. Introduction 79 1.1. Purpose 81 Many web based applications could benefit from knowing the timezone 82 of their visiting clients. Most of the dynamic content provider 83 applications depend on user accounts to display time and date in the 84 client's native timezone. This is a common problem and the current 85 solution is not always possible or adequate for reasons inlcuding: 87 o There may be no user accounts involved. News sites or RSS feeds 88 for example don't require users to have accounts. 90 o People may travel across timezone boundaries. Currently they need 91 to update their web accounts to reflect their actual timezone 92 information. 94 Furthermore, this is also the case for all HTTP-like or HTTP based 95 protocols that make use of timestamps. 97 This document addresses this need by describing a header to be used 98 by HTTP [RFC2616] so that interested clients may provide their 99 current timezone information to web servers and thus to web based 100 applications. 102 At the time of this writting GPS-enabled Internet access devices like 103 mobile phones are being deployed. In the near future, those devices 104 may be able to use GPS information and properly adjust their timezone 105 information. This could be of great help for people that travel 106 accross timezones. 108 1.2. Requirements 110 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 111 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 112 document are to be interpreted as described in [RFC2119]. 114 An implementation is not compliant if it fails to satisfy one or more 115 of the MUST or REQUIRED level requirements. An implementation that 116 satisfies all the MUST or REQUIRED level and all the SHOULD level 117 requirements is said to be "unconditionally compliant"; one that 118 satisfies all the MUST level requirements but not all the SHOULD 119 level requirements is said to be "conditionally compliant". 121 1.3. Terminology 123 This document uses the following terms: 125 HTTP client 126 Every client of the HTTP protocol. Commonly referred to as a web 127 browser. 129 Timezone string 130 A timezone string as described in this document. 132 HTTP header 133 An HTTP header as described in [RFC2616]. 135 The HTTP header specification of this document is presented in the 136 augmented Backus-Naur Form that is described in [RFC2616]. 138 1.4. Considerations 140 Because of the variety of systems on the Internet and the non- 141 technical nature of timezone, there is no simple method for a client 142 to provide timezone information to HTTP servers. During the writing 143 of this document the following were considered: 145 o Simplicity is a must. The specification needs to be as simple as 146 possible or allow for partial handling in a simple manter. 148 o There is a variety of timezone styles. Some countries don't 149 experience Daylight Saving Time (DST). Other countries have very 150 unstable DST. 152 o Politics affect DST. This makes it a moving target. 154 o DST settings may change from year to year. For example, in 2007 155 the DST start and end time in some states in USA were changed. 157 o Complete past and future timezone information cannot be described 158 using a simple string. 160 o End user systems may have an invalid timezone configured. 162 o There are systems without timezone information. 164 o Not all systems have a time source. 166 This document tries to provide adequate data for applications that 167 can take advantage of the Timezone information to fulfill their 168 needs. There are different levels of requirements that applications 169 may have or HTTP clients may be able to satisfy. Thus this document 170 introduces a way for HTTP clients to provide: 172 o The current client time. 174 o The current time offset. 176 o The current year's timezone information. 178 o Complete timezone information. 180 depending on their abilities. 182 Simple server side applications may just use the current time offset 183 and hope that it is correctly set. More advanced applications (like 184 calendars) need to know when a DST change will occur to correctly 185 represent future or past times. Even more advanced applications may 186 need to know the exact client timezone which can only be described 187 using a reference to a timezone database entry. Finally, 188 applications may choose to use the client's current time as reference 189 time and optionally ignore client timezone information. 191 An issue that was discussed when proposing this header was the need 192 of its existence. The alternative approach is to leave the time and 193 timezone information handling to server side applications which can 194 use geo-ip, user accounts, etc. This is not an option because: 196 o Geo-ip is not suitable for HTTPS clients behind a proxy. 198 o User accounts are not efficient for public pages like news sites, 199 blogs, forums, search engines, etc. 201 HTTP-based protocols may also take advantage of this feature. 203 Another consideration is the validity of client-side time or timezone 204 information. It seems that proper timezone information is gradually 205 being adopted as common behavior. Even though this document attempts 206 to help clients without timezone information and provide ultimate 207 flexibility to server side applications, the validity of the timezone 208 information is considered an existing precondition. This is in 209 accordance with paragraph 4.4 of [RFC3339] "Unqualified Local Time" 210 which considers systems with invalid timezone information as 211 inappropriate for Internet communications. 213 2. Definition 215 2.1. Client support 217 HTTP clients MAY provide local timezone information to visiting web 218 sites. This information is sent using the client-timezone HTTP 219 header: 221 client-timezone = "Timezone" ":" tzdescr 223 tzdescr = rfctime [ ";" posixtz [ ";" tznames ] ] 225 rfctime = 227 posixtz = 229 tznames = tzname *( "," tzname ) 231 tzname = 233 Where: 235 rfctime A local time string as specified in [RFC3339]. It 236 includes the current time offset. 238 posixtz A POSIX 1003.1 timezone string as specified in [POSIXTZ]. 240 tzname A timezone name. Many systems use a timezone name from a 241 timezone database. This is one such string. More than 242 one such strings may be provided. All of them MUST 243 identify the same timezone. 245 HTTP clients SHOULD provide all three parts of the header unless they 246 aren't able to do so or they are configured not to send timezone 247 information. 249 If a client does not provide a part of the header and there is 250 another part following that is provided, the client MUST use the 251 empty string for the part that is not provided. 253 Clients that don't have a clock source MUST use zeroes for all digits 254 of the datetime string except from the offset. "Z" MUST by used when 255 the offset is also unavailable. 257 When multiple references to timezone databases are specified the 258 server-side SHOULD perform a left-to-right search. This means that 259 the server-side application first searches its database for the first 260 provided timezone. If the search fails the search continues for the 261 second timezone, etc. The search ends when a matching entry is found 262 or there is no provided timezone database reference to search for. 263 The client side MUST assume that the server side uses this search 264 method. 266 2.2. Server support 268 Compliant servers MAY validate the format of the provided 269 information. Timezone strings that are not in a valid format MAY not 270 be accepted. Validation checks MUST NOT be performed on the content 271 of the Timezone string by servers. Only the format of the string may 272 be checked. This way outdated servers will not filter out proper 273 information. 275 2.3. Proxy considerations 277 HTTP proxy servers MUST NOT alter this information. HTTP proxy 278 servers MUST follow the same validation policy that was specified for 279 servers. 281 Server side scripts that produce customized results based on the 282 timezone information MUST return an appropriate "Vary" header as 283 specified in paragraph 14.44 of [RFC2616]. 285 3. Security Considerations 287 3.1. Client side 289 Timezone information may consist personal information regarding the 290 location of a person. HTTP clients MUST NOT provide this information 291 without letting the user prevent it. Clients must either ask users 292 or provide an option to enable/disable this feature. The later is 293 RECOMMENDED. 295 In most cases Timezone information will not disclose more personal 296 information than an IP address. HTTP clients MAY default in enabling 297 this to improve user experience. It is also possible that client 298 behavior regarding timezone information disclosure be controlled by 299 implicit privacy settings. 301 3.2. Server side 303 Web based applications MUST treat this information as user input that 304 may be invalid or malicious. 306 4. IANA Considerations 308 This specification requires registration of a Message Header Field 309 for HTTP [RFC3864]. 311 Header field: Timezone 313 Applicable protocol: HTTP 315 Status: Experimental 317 Author/change controller: 318 IETF (iesg@ietf.org) 319 Internet Engineering Task Force 321 Specification document: 322 [ this document ] 324 5. Acknowledgements 326 Timezone information in HTTP was also proposed by David Robinson in 327 an email at HTTP Working Group back in 1995 but the replies he got 328 were negative. It was believed that timezone information should be 329 handled by CGI scripts and not by the Hypertext Transfer Protocol. 330 The discussion can be found at http-wg mailing list archives: . 334 This document was properly formed thanks to the remarks of Julian 335 Reschke. 337 6. References 339 6.1. Normative 341 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 342 Requirement Levels", BCP 14, RFC 2119, March 1997. 344 [RFC2616] Fielding, R., Gettys, J., Mogul, J., Frystyk, H., 345 Masinter, L., Leach, P., and T. Berners-Lee, "Hypertext 346 Transfer Protocol -- HTTP/1.1", RFC 2616, June 1999. 348 [RFC3339] Klyne, G., Ed. and C. Newman, "Date and Time on the 349 Internet: Timestamps", RFC 3339, July 2002. 351 [RFC3864] Klyne, G., Nottingham, M., and J. Mogul, "Registration 352 Procedures for Message Header Fields", BCP 90, RFC 3864, 353 September 2004. 355 [POSIXTZ] IEEE, The Open Group, "IEEE Std 1003.1", 2004. 357 6.2. Informative 359 [I-D.rfc-editor-rfc2223bis] 360 Reynolds, J. and R. Braden, "Instructions to Request for 361 Comments (RFC) Authors", draft-rfc-editor-rfc2223bis-08 362 (work in progress), July 2004. 364 Appendix A. Examples 366 A complete timezone information header using the Olson timezone 367 database: 369 Assuming that current time is 12:00, Jul 30, 1977. Time offset is +2 370 hours. The full timezone string in [POSIXTZ] format is 371 EET2EEST3,M3.2.0/02:00,M11.1.0/02:00. The timezone database 372 identifier string is Europe/Athens: 374 Timezone: 1977-07-30T12:00+0200; 375 EET2EEST3,M3.2.0/02:00,M11.1.0/02:00; 376 Europe/Athens 378 A partial one: 380 GMT/UTC timezone is noted as Z(ulu). 382 Timezone: 2007-06-12T23:48Z 384 A header from a clock-less client: 386 Timezone: 0000-00-00T00:00+0200; 387 EET2EEST3,M3.2.0/02:00,M11.1.0/02:00; 388 Europe/Athens 390 A header with multiple database references (Olson and Microsoft 391 Windows timezone databases): 393 Timezone: 1977-07-30T12:00+0200; 394 EET2EEST3,M3.2.0/02:00,M11.1.0/02:00; 395 Europe/Athens;(GMT+02:00) Athens, Istanbul, Minsk 397 A header from a clock-less client without current offset information: 399 Timezone: 0000-00-00T00:00Z 401 A header with a missing part: 403 Timezone: 1977-07-30T12:00+0200;;Europe/Athens 405 Author's Address 407 Stefanos Harhalakis 408 Technological Educational Institute of Thessaloniki 409 Department of Information Technology 410 Thessaloniki, Greece 411 GR 413 Email: v13@v13.gr, v13@it.teithe.gr