In an HTTP profile exchange, profiles are embedded in HTTP headers. Currently, these headers are defined in this document. It is necessary that the exchange of attributes between service provider and user maintain the privacy of this information while in transit to the service provider. This specification encourages the use of SSL to establish a secure session prior to any exchange of attributes. This specification also encourages user agents to alert users as to the level of security employed in transit.
Profile writes encompass profile section creation, attribute creation, and attribute modification.
A detailed protocol description follows. A profile write is a simple transaction. A SetProfile header can be included in any HTTP response, much like a SetCookie header. Also like a SetCookie header, there is no guarantee the set will succeed, and it can only be checked with a profile read. If a user agent receives both a profile read and profile write request, all profile writes shall be attempted first, followed by the profile read.