Code change:
Sorry for noticing this so late. I don't think the security considerations of in retrofit work out. (Also CC NAME who is much better at web security than me.) If we introduce two ways to spell some field, we need to worry about whether this can allow various issues when sender and receiver don't agree on what's going on. The draft mostly leaves this to the future, but it does include some about this: This seems to put the onus on the sender, not the receiver. If you don't know the receiver accepts the alternate representation, you can't send it. It includes no corresponding receiver obligation, I guess on the assumption that if you see SF-Cookie, you can assume the sender meant it? I don't think that works. In a browser, the sender is a combination of browser logic (which has the final say) and JS (with a complex trust relationship). The browser logic specifies some which JS cannot set. Other HTTP systems have similar splits: an HTTP serving frontend may get fields from a CGI script or act as an intermediary, but it cannot allow the downstream code to specify fields like . These rules typically look like a blocklist with the default behavior to pass fields through. All this is to say, browsers won't let JS set the field directly, but setting is perfectly fine, up to CORS rules. A receiver may see that text and incorrectly assume that processing is fine, breaking some cookie invariants. Or vs , which will break some sites' CSRF processing. Beyond just blocklists, a retrofit-unaware HTTP cache that processes caching fields but passes through other fields will likely make a mess of the mapped caching fields. If we prefixed the names with , that would at least meet the browsers' rules, though I worry it'll still break other intermediaries. It's also a little unsatisfying of a fix. We could say that a receiver cannot process these either unless it's received some explicit negotiation that the sender knows about this. That's vague and unspecified, but probably would work, depending on what the intent is here. This is a bit handwaivy because I'm not sure what the use cases are here. But if we require explicit sender and receiver negotiation, it's unclear what we're getting out the parallel field names in the first place. It seems to me that's where all this risk comes from. Giving alternate names interferes with pass-through logic across the pipeline. Maybe we can get a more robust story, inspired a bit by (I'm just assuming this is one of the main use cases here) is to say: The text representation of is what it is. If this part of the system uses the text form, use the existing syntax The structured field representation of is this mapped thing. If this part of the system uses structured fields, use that syntax At boundaries where forms change, convert. We need to be a bit careful about fallibility here, but perhaps: Conversion from text to other forms is allowed to fail, since you can just fallback to the text form. Conversion from other forms to text probably needs to be stricter? The difference between mapped and normal fields is the structured field and text representations don't directly align, so they need to be treated a bit special Like I said, this is handwaivy and definitely incomplete. But it feels to me like something in this might be more sound. It makes it more obvious we have to be sure what representation we're using at each layer and there's no risk of one side thinking something is a generic header and another thinking it's an alternative representation of a special header.
This seems like a plausible risk to me. I'm not as familiar with non-browser use cases, but I can certainly imagine confusion that would result from clients being able to create mismatches between and . I can imagine ways to deal with this in browsers (in addition to NAME suggestions, we could add as a , just as we've done for and ). It's unclear how helpful that would be for non-browser usecases.
Main nuisance with prefix is that, on the receiver side, you don't know a priori if the client is an updated browser, which knows about the prefix, or a preexisting browser which does not. I suppose you could do UA sniffing, but let's not design a system that requires UA sniffing to work if we can help it! :-)
That's fair. would be safe without a change to Fetch. Still, given my expectations about the current deployment of mapped fields, I think we could reasonably get ahead of them in the browser world. Not at all sure about the rest of the ecosystem...
I like the direction that if you've already negotiated support, you could just replace the legacy headers with their spiffy (SFfy?) new equivalents using the same names, and if you haven't negotiated support then you have no business sending these variants and expecting them to work. Of course, that means this draft probably can't get away with "We don't define a way to negotiate this, but you do that."
I think we'd avoid needing "OUGHT TO" in that model. That model is more explicit that these are two incompatible representations of these fields. The negotiation requirements become more straightforward, I think: E.g. draft-nottingham-binary-structured-headers meets this requirement because you set a flag on the message, and gates usage on a setting. A hypothetical SF-based HTTP API would also meet this requirement because it's unambiguous that takes some in-memory structured field representation.
Hey David, Yes, I've been somewhat concerned about the potential issues in this area for a while. Minting new field names for the alternative forms was the initial approach, but I was half expecting someone to raise this issue :) One thing: No; the assumption is that a recipient sees SF-Cookie, they'll ignore it unless they've positively opted into it meaning something. Perhaps, as you point out, that should be more explicit -- e.g., say that these fields MUST NOT be processed unless the sender does [magic]. Making sure that evidence of [magic] is propagated properly may be tricky, though. I could also see removing the new field names. That should work for many contexts, although I suspect it might make handling the new forms difficult in some. Prefixing with doesn't seem very attractive to me.
Ah interesting. So I guess the middle option, "require explicit negotiation on the receiver" was actually the intended interpretation. That's not how I read the draft. It says "implementations are prohibited from generating such fields unless they have negotiated support for them with their peer" without saying anything about the recipient's responsibilities. So it sounds like, at minimum, we should update the draft. Getting that right in the presence of a chain of intermediaries is quite subtle however. Suppose we go A -> B -> C and both B and C support mapped fields, but A does not. B must be careful not to forward along a mapped field from A. E.g. it might decline to advertise mapped field support to C because A doesn't support it. Or it might reject all mapped field names from A, on grounds that it must have been invalid. Moreover, "intermedaries" has to be intepreted very loosely. Every processing step in the entire HTTP pipeline needs to carefully manage these alternate names. This seems a disaster waiting to happen. I think I'm now convinced this is the only plausible option. Regarding "many contexts" and "some", do you have use cases in mind here? I saw draft-nottingham-binary-structured-headers, but I gather there are others? Something to keep in mind is that this draft intentionally punts figuring out the negotiation design to the future anyway. That means this is also the more flexible option. If we define , etc., now, we have permanently committed ourselves to this security problem. If we decline to define now, we can still choose. We can always define the parallel field names later, should something that needs them come up. (Of course, I'd raise the security problem again, but it'll be easier to reason about with a concrete use case! )
I guess this raises another question: how do we handle mapped field values that cannot be represented in the underlying text representation? Given how many intermediaries and intermediary-like constructs are involved in HTTP pipelines, and given how every HTTP system today uses the current syntax, I suspect mapped values that cannot be represented in the original syntax have to be treated as an error. Which means I think we need to go through the exercise of writing SF-to-text converters for each mapped field and then narrowing the allowed inputs until that converter is infallible.
It sounds like removing the field names is the best path forward. Yes, for those, the application using retrofit needs a fallback, just as it does for compatible fields. If that isn't obvious from the document, it should be clarified -- perhaps in a new 'Using Retrofit Fields' section.
I could very well be incorrect, but it sounds we want to have alternatives per each hop. Does that mean that these mappings would be best represented by ther per-hop pseudo headers that we have in H2 and H3? Not that I feel that doing so would be the best option, though.
Ooh yeah, per-hop is a good way to think about this! For pseudoheader vs. something else, I suspect it'll depend on use? draft-nottingham-binary-structured-headers already has a flag, so it probably could just use the original names, though pseudoheader names would work too I suppose. The existing names has the minor benefit of being able to reuse the existing HPACK static table. Some sort of SF-based HTTP API like probably (?) doesn't want pseudoheaders in the API and can just use the original names. But I haven't put much thought into that. If one wanted to send them in their textual form in existing frames, we probably need pseudoheaders. Though I don't know if we really get much value out of defining that, over just using the existing syntax. shrug We can also punt this problem to documents that want to use this, if we're not sure yet. :-)
If you want to use an invalid field name, there are a lot more options than putting a ":" in the first byte. You need to negotiate that usage, but then you can do anything at all, including using that to signal lots of stuff. (If you want to avoid the extra byte, you can pack data into the high bit of each byte...)
I feel like punting is the right solution, unless we can come up with a convention that addresses the identified issues in all cases.
Not acting is a decision of a sort. But I'm not sure what that would concretely mean for retrofit? No prefix? Or just that we shouldn't worry yet about the effect this has on smuggling through WAFs and whatnot?
I think it means: No new header names; applications that use mapped fields need to define their own way to distinguish them A new section about these considerations

Related discussion:
text: 2. <del> The HTTP fields listed in compatible-fields can usually have their values handled as Structured Fields according to the listed parsing and serialisation algorithms in STRUCTURED-FIELDS, subject to the listed caveats. </del> <ins> The HTTP fields listed in compatible-fields have values that can be handled as Structured Field Values according to the parsing and serialisation algorithms in STRUCTURED-FIELDS corresponding to the listed top-level type, subject to the caveats in compatible-caveats. </ins> <del> The listed types are chosen for compatibility with the defined syntax of the field as well as with actual internet traffic.  However, not all instances of these fields will successfully parse.  This might be because the field value is clearly invalid, or it might be because it is valid but not parseable as a Structured Field. </del> <ins> The top-level types are chosen for compatibility with the defined syntax of the field as well as with actual internet traffic. However, not all instances of these fields will successfully parse as a Structured Field Value.  This might be because the field value is clearly invalid, or it might be because it is valid but not parseable as a Structured Field. </ins> An application using this specification will need to consider how to handle such field values.  Depending on its requirements, it might be advisable to reject such values, treat them as opaque strings, or <del> attempt to recover a structured value from them in an ad hoc fashion. </del> <ins> attempt to recover a Structured Field Value from them in an ad hoc fashion. 2.1. </ins> Note the following caveats regarding compatibility: 3. Some HTTP field values have syntax that cannot be successfully parsed <del> as Structured Fields.  Instead, it is necessary to map them into a separate Structured Field with an alternative name. </del> <ins> as Structured Field values.  Instead, it is necessary to map them into a Structured Field value. </ins> For example, the Date HTTP header field carries a date: Its value would be mapped to: <del> As in compatible, these fields are unable to carry values that are not valid Structured Fields, and so an application using this specification will need to how to support such values.  Typically, handling them using the original field name is sufficient. Each field name listed below indicates a replacement field name and a means of mapping its original value into a Structured Field. </del> <ins> Unlike those listed in compatible, these representations are not compatible with the original fields' syntax, and MUST NOT be used unless they are explicitly and unambiguously supported.  For example, this means that sending them to a next-hop recipient in HTTP requires prior negotiation.  This specification does not define how to do so. </ins> 3.1. <del> The field names in url-fields (paired with their mapped field names) have values that can be mapped into Structured Fields by treating the original field's value as a String. </del> <ins> The field names in url-fields have values that can be mapped into Structured Field values by treating the original field's value as a String. </ins> <del> For example, this Location field </del> <ins> For example, this Location field: </ins> <del> could be mapped as: </del> <ins> would have a mapped value of: </ins> 3.2. <del> The field names in date-fields (paired with their mapped field names) have values that can be mapped into Structured Fields by parsing their payload according to HTTP and representing the result as a Date. </del> <ins> The field names in date-fields have values that can be mapped into Structured Field values by parsing their payload according to HTTP and representing the result as a Date. </ins> <del> For example, an Expires field could be mapped as: </del> <ins> For example, an Expires field's value could be mapped as: </ins> 3.3. <del> The field value of the ETag header field can be mapped into the SF- ETag Structured Field by representing the entity-tag as a String, and the weakness flag as a Boolean "w" parameter on it, where true </del> <ins> The field value of the ETag header field can be mapped into a Structured Field value by representing the entity-tag as a String, and the weakness flag as a Boolean "w" parameter on it, where true </ins> indicates that the entity-tag is weak; if 0 or unset, the entity-tag is strong. <del> For example, this: </del> <ins> For example, this ETag header field: would have a mapped value of: If-None-Match's field value can be mapped into a Structured Field value which is a List of the structure described above.  When a field value contains "*", it is represented as a Token. </ins> <del> If-None-Match's field value can be mapped into the SF-If-None-Match Structured Field, which is a List of the structure described above. When a field value contains "*", it is represented as a Token. </del> <ins> Likewise, If-Match's field value can be mapped into a Structured Field value in the same manner. </ins> <del> Likewise, If-Match's field value can be mapped into the SF-If-Match Structured Field in the same manner. </del> <ins> For example, this If-None-Match field: </ins> <del> For example: </del> <ins> would have a mapped value of: </ins> 3.4. The field values of the Cookie and Set-Cookie fields COOKIES can be <del> mapped into the SF-Cookie Structured Field (a List) and SF-Set-Cookie Structured Field (a List), respectively. </del> <ins> mapped into Structured Fields Lists. </ins> In each case, a cookie is represented as an Inner List containing two Items; the cookie name and value.  The cookie name is always a