Source: https://trac.ietf.org/trac/httpbis/export/1428/draft-ietf-httpbis/latest/p2-semantics.html
Timestamp: 2019-11-21 10:39:23
Document Index: 67389122

Matched Legal Cases: ['art1', 'art4', 'art 4', 'art7', 'art 7', 'art1', 'art1', 'art3', 'art4', 'art5', 'art6', 'art7']

8.1 Allow
8.2 Expect
8.3 From
8.5 Max-Forwards
8.6 Referer
8.7 Retry-After
8.8 Server
8.9 User-Agent
9.1 Method Registry
9.2 Status Code Registry
10.1 Transfer of Sensitive Information
10.2 Encoding Sensitive Information in URIs
10.3 Location Headers and Spoofing
10.4 Security Considerations for CONNECT
The list of methods allowed by a resource can be specified in an Allow header field (Section 8.1). The status code of the response always notifies the client whether a method is currently allowed on a resource, since the set of allowed methods can change dynamically. An origin server SHOULD respond with the status code 405 (Method Not Allowed) if the method is known by the origin server but not allowed for the resource, and 501 (Not Implemented) if the method is unrecognized or not implemented by the origin server. The methods GET and HEAD MUST be supported by all general-purpose servers. All other methods are OPTIONAL; however, if the above methods are implemented, they MUST be implemented with the same semantics as those specified in Section 6.
Under what conditions the header field can be used; e.g., only i responses or requests, in all messages, only on responses to a particular request method.
Whether the header field is useful or allowable in trailers (see Section 6.2.1 of [Part1] ).
Expect Section 8.2
From Section 8.3
Max-Forwards Section 8.5
Referer Section 8.6
User-Agent Section 8.9
Allow Section 8.1
Location Section 8.4
Retry-After Section 8.7
Server Section 8.8
The Max-Forwards header field MAY be used to target a specific proxy in the request chain (see Section 8.5). If no Max-Forwards field is present in the request, then the forwarded request MUST NOT include a Max-Forwards field.
See Section 10.2 for security considerations when used for forms.
If a resource has been created on the origin server, the response SHOULD be 201 (Created) and contain a representation which describes the status of the request and refers to the new resource, and a Location header field (see Section 8.4).
The TRACE method requests a remote, application-layer loop-back of the request message. The final recipient of the request SHOULD reflect the message received back to the client as the message-body of a 200 (OK) response. The final recipient is either the origin server or the first proxy to receive a Max-Forwards value of zero (0) in the request (see Section 8.5). A TRACE request MUST NOT include a message-body.
The 303 status code indicates that the server is redirecting the user agent to a different resource, as indicated by a URI in the Location header field, that is intended to provide an indirect response to the original request. In order to satisfy the original request, a user agent SHOULD perform a retrieval request using the Location URI, which may itself be redirected further, and present the eventual result as an answer to the original request. Note that the new URI in the Location header field is not considered equivalent to the effective request URI.
The expectation given in an Expect header field (see Section 8.2) could not be met by this server, or, if the server is a proxy, the server has unambiguous evidence that the request could not be met by the next-hop server.
The implication is that this is a temporary condition which will be alleviated after some delay. If known, the length of the delay MAY be indicated in a Retry-After header field (Section 8.7). If no Retry-After is given, the client SHOULD handle the response as it would for a 500 response.
If the field value is a relative URI, it SHOULD be interpreted relative to the effective request URI. The URI MUST NOT include a fragment. See Section 10.2 for security considerations.
Allow http standard Section 8.1
Expect http standard Section 8.2
From http standard Section 8.3
Location http standard Section 8.4
Max-Forwards http standard Section 8.5
Referer http standard Section 8.6
Retry-After http standard Section 8.7
Server http standard Section 8.8
User-Agent http standard Section 8.9
The User-Agent (Section 8.9) or Server (Section 8.8) header fields can sometimes be used to determine that a specific client or server have a particular security hole which might be exploited. Unfortunately, this same information is often used for other valuable purposes for which HTTP currently has no better mechanism.
[Part4] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., and J. Reschke, Ed., “HTTP/1.1, part 4: Conditional Requests”, Internet-Draft draft-ietf-httpbis-p4-conditional-latest (work in progress), September 2011.
[Part7] Fielding, R., Ed., Gettys, J., Mogul, J., Frystyk, H., Masinter, L., Leach, P., Berners-Lee, T., Lafon, Y., Ed., and J. Reschke, Ed., “HTTP/1.1, part 7: Authentication”, Internet-Draft draft-ietf-httpbis-p7-auth-latest (work in progress), September 2011.
Reclassify "Allow" as response header field, removing the option to specify it in a PUT request. Relax the server requirement on the contents of the Allow header field and remove requirement on clients to always trust the header field value. (Section 8.1)
Correct syntax of Location header field to allow URI references (including relative references and fragments), as referred symbol "absoluteURI" wasn't what was expected, and add some clarifications as to when use of fragments would not be appropriate. (Section 8.4)
Restrict Max-Forwards header field to OPTIONS and TRACE (previously, extension methods could have used it as well). (Section 8.5)
Allow Referer field value of "about:blank" as alternative to not specifying it. (Section 8.6)
In the description of the Server header field, the Via field was described as a SHOULD. The requirement was and is stated correctly in the description of the Via header field in Section 9.9 of [Part1] . (Section 8.8)
100 Continue (status code) 4.1, 7.1.1, 9.2
101 Switching Protocols (status code) 4.1, 7.1.2, 9.2
200 OK (status code) 4.1, 7.2.1, 9.2
201 Created (status code) 4.1, 7.2.2, 9.2
202 Accepted (status code) 4.1, 7.2.3, 9.2
203 Non-Authoritative Information (status code) 4.1, 7.2.4, 9.2, A
204 No Content (status code) 4.1, 7.2.5, 9.2
205 Reset Content (status code) 4.1, 7.2.6, 9.2
300 Multiple Choices (status code) 4.1, 7.3.1, 9.2
301 Moved Permanently (status code) 4.1, 7.3.2, 9.2, A
302 Found (status code) 4.1, 7.3.3, 9.2, A
303 See Other (status code) 4.1, 7.3.4, 9.2
305 Use Proxy (status code) 4.1, 7.3.6, 9.2, A
306 (Unused) (status code) 7.3.7, 9.2
307 Temporary Redirect (status code) 4.1, 7.3.8, 9.2, A
400 Bad Request (status code) 4.1, 7.4.1, 9.2
402 Payment Required (status code) 4.1, 7.4.3, 9.2
403 Forbidden (status code) 4.1, 7.4.4, 9.2
404 Not Found (status code) 4.1, 7.4.5, 9.2
405 Method Not Allowed (status code) 4.1, 7.4.6, 9.2
406 Not Acceptable (status code) 4.1, 7.4.7, 9.2
407 Proxy Authentication Required (status code) 7.4.8, 9.2
408 Request Timeout (status code) 4.1, 7.4.9, 9.2
409 Conflict (status code) 4.1, 7.4.10, 9.2
410 Gone (status code) 4.1, 7.4.11, 9.2
411 Length Required (status code) 4.1, 7.4.12, 9.2
413 Request Representation Too Large (status code) 4.1, 7.4.14, 9.2
414 URI Too Long (status code) 4.1, 7.4.15, 9.2
415 Unsupported Media Type (status code) 4.1, 7.4.16, 9.2
417 Expectation Failed (status code) 4.1, 7.4.18, 9.2
426 Upgrade Required (status code) 4.1, 7.4.19, 9.2, A
500 Internal Server Error (status code) 4.1, 7.5.1, 9.2
501 Not Implemented (status code) 4.1, 7.5.2, 9.2
502 Bad Gateway (status code) 4.1, 7.5.3, 9.2
503 Service Unavailable (status code) 4.1, 7.5.4, 9.2
504 Gateway Timeout (status code) 4.1, 7.5.5, 9.2
505 HTTP Version Not Supported (status code) 4.1, 7.5.6, 9.2
Allow header field 2, 3.3, 8.1, 9.3, A
CONNECT method 2.1, 6.9, 9.1, A
DELETE method 2.1, 6.7, 9.1
Expect header field 3.2, 7.4.18, 8.2, 9.3
From header field 3.2, 8.3, 9.3
GET method 2.1, 6.3, 9.1
Allow 8.1
delta-seconds 8.7
Expect 8.2
expect-params 8.2
expectation 8.2
expectation-extension 8.2
Max-Forwards 8.5
Referer 8.6
Retry-After 8.7
User-Agent 8.9
HEAD method 2.1, 6.4, 9.1
Allow 2, 3.3, 8.1, 9.3, A
Expect 3.2, 7.4.18, 8.2, 9.3
From 3.2, 8.3, 9.3
Location 3.3, 6.5, 8.4, 9.3, A
Max-Forwards 3.2, 6.2, 6.8, 8.5, 9.3, A
Referer 3.2, 8.6, 9.3, A
Retry-After 3.3, 7.5.4, 8.7, 9.3
Server 3.3, 8.8, 9.3, 10.1, A
User-Agent 3.2, 8.9, 9.3, 10.1
Location header field 3.3, 6.5, 8.4, 9.3, A
Max-Forwards header field 3.2, 6.2, 6.8, 8.5, 9.3, A
CONNECT 2.1, 6.9, 9.1, A
DELETE 2.1, 6.7, 9.1
GET 2.1, 6.3, 9.1
HEAD 2.1, 6.4, 9.1
OPTIONS 2.1, 6.2, 8.5, 9.1
POST 2.1, 6.5, 9.1, A
PUT 2.1, 6.6, 9.1, A
TRACE 2.1, 6.8, 8.5, 9.1, 10.1
OPTIONS method 2.1, 6.2, 8.5, 9.1
Part1 1, 1.2, 1.2.1, 1.2.1, 1.2.1, 1.2.1, 1.2.1, 1.2.1, 1.2.2, 1.2.2, 1.2.2, 1.2.2, 1.2.2, 1.2.2, 2, 2.2.1, 3, 3.1, 3.1, 3.1, 3.1, 3.1, 3.2, 3.2, 3.3, 5, 5.1, 6.8, 6.8, 6.9, 7.1.1, 7.1.2, 7.2.4, 7.2.6, 7.4.19, 7.5.6, 8.2, 8.8, 8.8, 8.8, 8.9, 8.9, 11, 12.1, A
Section 3.2 1.2.2, 3, 3.1, 8.8, 8.9
Section 4.1.2 6.9
Section 6.2.1 3.1
Section 6.3 1.2.2, 8.8, 8.9
Section 7.2.3 7.1.1, 8.2
Section 9.5 3.2
Section 9.8 7.1.2, 7.4.19
Section 9.9 6.8, 8.8, A
Section 12 11
Part3 3.2, 3.2, 3.2, 3.2, 5, 6.5, 7.3, 7.3.1, 7.4.7, 8.4, 12.1
Section 6.7 6.5, 8.4
Part4 3.2, 3.2, 3.2, 3.2, 3.3, 4.1, 4.1, 4.1, 7.2.2, 7.3.5, 7.4.13, 12.1, C.2
Part5 3.2, 3.2, 3.3, 4.1, 4.1, 4.1, 6.3, 7.2.7, 7.4.17, 7.4.17, 12.1
Part6 2.2.1, 3.1, 3.3, 3.3, 4.2.1, 6.3, 6.4, 6.5, 6.6, 6.7, 7.2.1, 7.2.4, 7.2.4, 7.2.4, 7.2.7, 7.3.1, 7.3.2, 7.4.11, 12.1
Part7 3.2, 3.2, 3.3, 3.3, 4.1, 4.1, 4.1, 7.4.2, 7.4.8, 12.1
POST method 2.1, 6.5, 9.1, A
PUT method 2.1, 6.6, 9.1, A
Referer header field 3.2, 8.6, 9.3, A
Retry-After header field 3.3, 7.5.4, 8.7, 9.3
RFC1945 7.3, 12.2
RFC2068 7.3, 7.3, 12.2
RFC2616 1, 7.3, 12.2, C.1
RFC2817 9.2, 12.2, A, A, A
Section 7.1 9.2, A
RFC3864 3.1, 3.1, 9.3, 12.2
RFC3986 8.4, 8.4, 12.1
Section 4.2 8.4
Section 5 8.4
RFC5226 2.2, 4.2, 12.2
RFC5234 1.2, 1.2, 3.1, 12.1
RFC5322 8.3, 8.3, 12.2
Section 3.4 8.3, 8.3
RFC5789 6.6, 12.2
RFC5987 3.1, 12.2
Server header field 3.3, 8.8, 9.3, 10.1, A
100 Continue 4.1, 7.1.1, 9.2
101 Switching Protocols 4.1, 7.1.2, 9.2
200 OK 4.1, 7.2.1, 9.2
201 Created 4.1, 7.2.2, 9.2
202 Accepted 4.1, 7.2.3, 9.2
203 Non-Authoritative Information 4.1, 7.2.4, 9.2, A
204 No Content 4.1, 7.2.5, 9.2
205 Reset Content 4.1, 7.2.6, 9.2
300 Multiple Choices 4.1, 7.3.1, 9.2
301 Moved Permanently 4.1, 7.3.2, 9.2, A
302 Found 4.1, 7.3.3, 9.2, A
303 See Other 4.1, 7.3.4, 9.2
305 Use Proxy 4.1, 7.3.6, 9.2, A
306 (Unused) 7.3.7, 9.2
307 Temporary Redirect 4.1, 7.3.8, 9.2, A
400 Bad Request 4.1, 7.4.1, 9.2
402 Payment Required 4.1, 7.4.3, 9.2
403 Forbidden 4.1, 7.4.4, 9.2
404 Not Found 4.1, 7.4.5, 9.2
405 Method Not Allowed 4.1, 7.4.6, 9.2
406 Not Acceptable 4.1, 7.4.7, 9.2
407 Proxy Authentication Required 7.4.8, 9.2
408 Request Timeout 4.1, 7.4.9, 9.2
409 Conflict 4.1, 7.4.10, 9.2
410 Gone 4.1, 7.4.11, 9.2
411 Length Required 4.1, 7.4.12, 9.2
413 Request Representation Too Large 4.1, 7.4.14, 9.2
414 URI Too Long 4.1, 7.4.15, 9.2
415 Unsupported Media Type 4.1, 7.4.16, 9.2
417 Expectation Failed 4.1, 7.4.18, 9.2
426 Upgrade Required 4.1, 7.4.19, 9.2, A
500 Internal Server Error 4.1, 7.5.1, 9.2
501 Not Implemented 4.1, 7.5.2, 9.2
502 Bad Gateway 4.1, 7.5.3, 9.2
503 Service Unavailable 4.1, 7.5.4, 9.2
504 Gateway Timeout 4.1, 7.5.5, 9.2
505 HTTP Version Not Supported 4.1, 7.5.6, 9.2
TRACE method 2.1, 6.8, 8.5, 9.1, 10.1
User-Agent header field 3.2, 8.9, 9.3, 10.1