Source: https://trac.ietf.org/trac/httpbis/browser/draft-ietf-httpbis/latest/p5-range.html?rev=2554
Timestamp: 2020-05-25 21:40:05
Document Index: 160112330

Matched Legal Cases: ['art1', 'art1', 'art1', 'art2', 'art2', 'art2', 'art4', 'art4', 'art4', 'art4', 'art4', 'art4', 'art4', 'art4', 'art4', 'art4', 'art4', 'art4', 'art6', 'art6', 'art6', 'art4', 'art4', 'art4', 'art1', 'art1', 'art1', 'art2', 'art2', 'art2', 'art1', 'art1', 'art1', 'art1', 'art1', 'art1', 'art1', 'art1', 'art1', 'art1', 'art1', 'art1', 'art2', 'art2', 'art2', 'art4', 'art4', 'art4', 'art1', 'art1', 'art1', 'art1', 'art1', 'art1', 'art1', 'art1', 'art1', 'art1', 'art1', 'art1', 'art1', 'art1', 'art1', 'art1', 'art1', 'art2', 'art2', 'art2', 'art2', 'art2', 'art2', 'art2', 'art4', 'art4', 'art4', 'art4', 'art4', 'art4', 'art4', 'art4', 'art4', 'art4', 'art4', 'art4', 'art4', 'art6']

source: draft-ietf-httpbis/latest/p5-range.html @ 2554
Last change on this file since 2554 was 2554, checked in by julian.reschke@…, 6 years ago
add the "stateless" term to abstracts (see #538)
content: "January 2014";
content: "Expires July 21, 2014";
<meta name="generator" content="http://greenbytes.de/tech/webdav/rfc2629.xslt, Revision 1.611, 2013/11/27 12:23:51, XSLT vendor: SAXON 8.9 from Saxonica http://www.saxonica.com/">
<meta name="dct.issued" scheme="ISO8601" content="2014-01-17">
<td class="left">Expires: July 21, 2014</td>
<td class="right">January 17, 2014</td>
<p>The changes in this draft are summarized in <a href="#changes.since.25" title="Since draft-ietf-httpbis-p5-range-25">Appendix&nbsp;E.2</a>.
<p>This Internet-Draft will expire on July 21, 2014.</p>
<li><a href="#rfc.section.E.1">E.1</a>&nbsp;&nbsp;&nbsp;<a href="#changes.since.24">Since draft-ietf-httpbis-p5-range-24</a></li>
<li><a href="#rfc.section.E.2">E.2</a>&nbsp;&nbsp;&nbsp;<a href="#changes.since.25">Since draft-ietf-httpbis-p5-range-25</a></li>
<p id="rfc.section.1.2.p.1">This specification uses the Augmented Backus-Naur Form (ABNF) notation of <a href="#RFC5234" id="rfc.xref.RFC5234.1"><cite title="Augmented BNF for Syntax Specifications: ABNF">[RFC5234]</cite></a> with a list extension, defined in <a href="p1-messaging.html#abnf.extension" title="ABNF list extension: #rule">Section 7</a> of <a href="#Part1" id="rfc.xref.Part1.2"><cite title="Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing">[Part1]</cite></a>, that allows for compact definition of comma-separated lists using a '#' operator (similar to how the '*' operator indicates
any representation transferable over HTTP (<a href="p2-semantics.html#representations" title="Representations">Section 3</a> of <a href="#Part2" id="rfc.xref.Part2.1"><cite title="Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content">[Part2]</cite></a>). We define the "bytes" range unit for expressing subranges of the data's octet sequence.
order, since both are indications of either a broken client or a deliberate denial of service attack (<a href="#overlapping.ranges" title="Denial of Service Attacks using Range">Section&nbsp;6.1</a>). A client <em class="bcp14">SHOULD NOT</em> request multiple ranges that are inherently less efficient to process and transfer than a single range that encompasses the
<p id="rfc.section.3.1.p.7">The Range header field is evaluated after evaluating the precondition header fields defined in <a href="#Part4" id="rfc.xref.Part4.1"><cite title="Hypertext Transfer Protocol (HTTP/1.1): Conditional Requests">[Part4]</cite></a>, and only if the result in absence of the Range header field would be a <a href="p2-semantics.html#status.200" class="smpl">200 (OK)</a> response. In other words, Range is ignored when a conditional GET would result in a <a href="p4-conditional.html#status.304" class="smpl">304 (Not Modified)</a> response.
by <a href="p4-conditional.html#lastmod.comparison" title="Comparison">Section 2.2.2</a> of <a href="#Part4" id="rfc.xref.Part4.2"><cite title="Hypertext Transfer Protocol (HTTP/1.1): Conditional Requests">[Part4]</cite></a>.
<p id="rfc.section.3.2.p.6">A server that evaluates an If-Range precondition <em class="bcp14">MUST</em> use the strong comparison function when comparing entity-tags (<a href="p4-conditional.html#entity.tag.comparison" title="Comparison">Section 2.3.2</a> of <a href="#Part4" id="rfc.xref.Part4.3"><cite title="Hypertext Transfer Protocol (HTTP/1.1): Conditional Requests">[Part4]</cite></a>) and <em class="bcp14">MUST</em> evaluate the condition as false if an <a href="#imported.abnf" class="smpl">HTTP-date</a> validator is provided that is not a strong validator in the sense defined by <a href="p4-conditional.html#lastmod.comparison" title="Comparison">Section 2.2.2</a> of <a href="#Part4" id="rfc.xref.Part4.4"><cite title="Hypertext Transfer Protocol (HTTP/1.1): Conditional Requests">[Part4]</cite></a>. (A server can distinguish between a valid <a href="#imported.abnf" class="smpl">HTTP-date</a> and any form of entity-tag by examining the first two characters.)
resource, then the server <em class="bcp14">SHOULD</em> process the <a href="#header.range" class="smpl">Range</a> header field as requested. If the validator does not match, the server <em class="bcp14">MUST</em> ignore the <a href="#header.range" class="smpl">Range</a> header field.
<p id="rfc.section.4.1.p.12">A 206 response is cacheable by default; i.e., unless otherwise indicated by explicit cache controls (see <a href="p6-cache.html#heuristic.freshness" title="Calculating Heuristic Freshness">Section 4.2.2</a> of <a href="#Part6" id="rfc.xref.Part6.1"><cite title="Hypertext Transfer Protocol (HTTP/1.1): Caching">[Part6]</cite></a>).
These ranges can only be safely combined if they all have in common the same strong validator (<a href="p4-conditional.html#weak.and.strong.validators" title="Weak versus Strong">Section 2.1</a> of <a href="#Part4" id="rfc.xref.Part4.5"><cite title="Hypertext Transfer Protocol (HTTP/1.1): Conditional Requests">[Part4]</cite></a>).
<p id="rfc.section.5.1.p.1">The HTTP Range Unit Registry defines the name space for the range unit names and refers to their corresponding specifications.
<p id="rfc.section.6.p.1">This section is meant to inform developers, information providers, and users of known security concerns specific to the HTTP/1.1
range request mechanisms. More general security considerations are addressed in HTTP messaging <a href="#Part1" id="rfc.xref.Part1.3"><cite title="Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing">[Part1]</cite></a> and semantics <a href="#Part2" id="rfc.xref.Part2.2"><cite title="Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content">[Part2]</cite></a>.
<p id="rfc.section.6.p.2">The list of considerations below is not exhaustive — security analysis in an ongoing activity. Various organizations, such
as the "Open Web Application Security Project" (OWASP, &lt;<a href="https://www.owasp.org/">https://www.owasp.org/</a>&gt;), provide information about current research.
<p id="rfc.section.6.1.p.1">Unconstrained multiple range requests are susceptible to denial of service attacks because the effort required to request
<p id="rfc.section.7.p.1">See <a href="p1-messaging.html#acks" title="Acknowledgments">Section 10</a> of <a href="#Part1" id="rfc.xref.Part1.4"><cite title="Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing">[Part1]</cite></a>.
<td class="top"><a href="mailto:fielding@gbiv.com" title="Adobe Systems Incorporated">Fielding, R., Ed.</a> and <a href="mailto:julian.reschke@greenbytes.de" title="greenbytes GmbH">J. Reschke, Ed.</a>, “<a href="http://tools.ietf.org/html/draft-ietf-httpbis-p1-messaging-latest">Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing</a>”, Internet-Draft&nbsp;draft-ietf-httpbis-p1-messaging-latest (work in progress), January&nbsp;2014.
<td class="top"><a href="mailto:fielding@gbiv.com" title="Adobe Systems Incorporated">Fielding, R., Ed.</a> and <a href="mailto:julian.reschke@greenbytes.de" title="greenbytes GmbH">J. Reschke, Ed.</a>, “<a href="http://tools.ietf.org/html/draft-ietf-httpbis-p2-semantics-latest">Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content</a>”, Internet-Draft&nbsp;draft-ietf-httpbis-p2-semantics-latest (work in progress), January&nbsp;2014.
<td class="top"><a href="mailto:fielding@gbiv.com" title="Adobe Systems Incorporated">Fielding, R., Ed.</a> and <a href="mailto:julian.reschke@greenbytes.de" title="greenbytes GmbH">J. Reschke, Ed.</a>, “<a href="http://tools.ietf.org/html/draft-ietf-httpbis-p4-conditional-latest">Hypertext Transfer Protocol (HTTP/1.1): Conditional Requests</a>”, Internet-Draft&nbsp;draft-ietf-httpbis-p4-conditional-latest (work in progress), January&nbsp;2014.
<td class="top"><a href="mailto:fielding@gbiv.com" title="Adobe Systems Incorporated">Fielding, R., Ed.</a>, <a href="mailto:mnot@mnot.net" title="Akamai">Nottingham, M., Ed.</a>, and <a href="mailto:julian.reschke@greenbytes.de" title="greenbytes GmbH">J. Reschke, Ed.</a>, “<a href="http://tools.ietf.org/html/draft-ietf-httpbis-p6-cache-latest">Hypertext Transfer Protocol (HTTP/1.1): Caching</a>”, Internet-Draft&nbsp;draft-ietf-httpbis-p6-cache-latest (work in progress), January&nbsp;2014.
<p id="rfc.section.C.p.3">The rules below are defined in <a href="#Part1" id="rfc.xref.Part1.5"><cite title="Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing">[Part1]</cite></a>:
<div id="rfc.figure.u.29"></div><pre class="inline"> <a href="#imported.abnf" class="smpl">OWS</a> = &lt;OWS, defined in <a href="#Part1" id="rfc.xref.Part1.6"><cite title="Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing">[Part1]</cite></a>, <a href="p1-messaging.html#whitespace" title="Whitespace">Section 3.2.3</a>&gt;
<a href="#imported.abnf" class="smpl">token</a> = &lt;token, defined in <a href="#Part1" id="rfc.xref.Part1.7"><cite title="Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing">[Part1]</cite></a>, <a href="p1-messaging.html#field.components" title="Field value components">Section 3.2.6</a>&gt;
<div id="rfc.figure.u.30"></div><pre class="inline"> <a href="#imported.abnf" class="smpl">HTTP-date</a> = &lt;HTTP-date, defined in <a href="#Part2" id="rfc.xref.Part2.3"><cite title="Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content">[Part2]</cite></a>, <a href="p2-semantics.html#http.date" title="Date/Time Formats">Section 7.1.1.1</a>&gt;
<a href="#imported.abnf" class="smpl">entity-tag</a> = &lt;entity-tag, defined in <a href="#Part4" id="rfc.xref.Part4.6"><cite title="Hypertext Transfer Protocol (HTTP/1.1): Conditional Requests">[Part4]</cite></a>, <a href="p4-conditional.html#header.etag" title="ETag">Section 2.3</a>&gt;
<p id="rfc.section.D.p.1">In the collected ABNF below, list rules are expanded as per <a href="p1-messaging.html#notation" title="Syntax Notation">Section 1.2</a> of <a href="#Part1" id="rfc.xref.Part1.8"><cite title="Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing">[Part1]</cite></a>.
<h1 id="rfc.section.E"><a href="#rfc.section.E">E.</a>&nbsp;<a href="#change.log">Change Log (to be removed by RFC Editor before publication)</a></h1>
<p id="rfc.section.E.p.1">Changes up to the IETF Last Call draft are summarized in &lt;<a href="http://tools.ietf.org/html/draft-ietf-httpbis-p5-range-24#appendix-E">http://tools.ietf.org/html/draft-ietf-httpbis-p5-range-24#appendix-E</a>&gt;.
<h2 id="rfc.section.E.1"><a href="#rfc.section.E.1">E.1</a>&nbsp;<a href="#changes.since.24">Since draft-ietf-httpbis-p5-range-24</a></h2>
<li>&lt;<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/506">http://tools.ietf.org/wg/httpbis/trac/ticket/506</a>&gt;: "APPSDIR review of draft-ietf-httpbis-p5-range-24"
<li>&lt;<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/507">http://tools.ietf.org/wg/httpbis/trac/ticket/507</a>&gt;: "integer value parsing"
<li>&lt;<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/508">http://tools.ietf.org/wg/httpbis/trac/ticket/508</a>&gt;: "broken sentence in description of 206"
<h2 id="rfc.section.E.2"><a href="#rfc.section.E.2">E.2</a>&nbsp;<a href="#changes.since.25">Since draft-ietf-httpbis-p5-range-25</a></h2>
<li>&lt;<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/526">http://tools.ietf.org/wg/httpbis/trac/ticket/526</a>&gt;: "check media type registration templates"
<li>&lt;<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/527">http://tools.ietf.org/wg/httpbis/trac/ticket/527</a>&gt;: "use of CHAR for other-range-set"
<li>&lt;<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/538">http://tools.ietf.org/wg/httpbis/trac/ticket/538</a>&gt;: "add 'stateless' to Abstract"
<li>&lt;<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/542">http://tools.ietf.org/wg/httpbis/trac/ticket/542</a>&gt;: "improve introduction of list rule"
<li>&lt;<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/549">http://tools.ietf.org/wg/httpbis/trac/ticket/549</a>&gt;: "augment security considerations with pointers to current research"
<p class="noprint"><a href="#rfc.index.2">2</a> <a href="#rfc.index.4">4</a> <a href="#rfc.index.A">A</a> <a href="#rfc.index.B">B</a> <a href="#rfc.index.C">C</a> <a href="#rfc.index.G">G</a> <a href="#rfc.index.I">I</a> <a href="#rfc.index.M">M</a> <a href="#rfc.index.P">P</a> <a href="#rfc.index.R">R</a>
<li><em>Part1</em>&nbsp;&nbsp;<a href="#rfc.xref.Part1.1">1.1</a>, <a href="#rfc.xref.Part1.2">1.2</a>, <a href="#rfc.xref.Part1.3">6</a>, <a href="#rfc.xref.Part1.4">7</a>, <a href="#Part1"><b>8.1</b></a>, <a href="#rfc.xref.Part1.5">C</a>, <a href="#rfc.xref.Part1.6">C</a>, <a href="#rfc.xref.Part1.7">C</a>, <a href="#rfc.xref.Part1.8">D</a><ul>
<li><em>Section 1.2</em>&nbsp;&nbsp;<a href="#rfc.xref.Part1.8">D</a></li>
<li><em>Section 3.2.3</em>&nbsp;&nbsp;<a href="#rfc.xref.Part1.6">C</a></li>
<li><em>Section 3.2.6</em>&nbsp;&nbsp;<a href="#rfc.xref.Part1.7">C</a></li>
<li><em>Section 10</em>&nbsp;&nbsp;<a href="#rfc.xref.Part1.4">7</a></li>
<li><em>Part2</em>&nbsp;&nbsp;<a href="#rfc.xref.Part2.1">2.1</a>, <a href="#rfc.xref.Part2.2">6</a>, <a href="#Part2"><b>8.1</b></a>, <a href="#rfc.xref.Part2.3">C</a><ul>
<li><em>Section 3</em>&nbsp;&nbsp;<a href="#rfc.xref.Part2.1">2.1</a></li>
<li><em>Section 7.1.1.1</em>&nbsp;&nbsp;<a href="#rfc.xref.Part2.3">C</a></li>
<li><em>Part4</em>&nbsp;&nbsp;<a href="#rfc.xref.Part4.1">3.1</a>, <a href="#rfc.xref.Part4.2">3.2</a>, <a href="#rfc.xref.Part4.3">3.2</a>, <a href="#rfc.xref.Part4.4">3.2</a>, <a href="#rfc.xref.Part4.5">4.3</a>, <a href="#Part4"><b>8.1</b></a>, <a href="#rfc.xref.Part4.6">C</a><ul>
<li><em>Section 2.1</em>&nbsp;&nbsp;<a href="#rfc.xref.Part4.5">4.3</a></li>
<li><em>Section 2.2.2</em>&nbsp;&nbsp;<a href="#rfc.xref.Part4.2">3.2</a>, <a href="#rfc.xref.Part4.4">3.2</a></li>
<li><em>Section 2.3</em>&nbsp;&nbsp;<a href="#rfc.xref.Part4.6">C</a></li>
<li><em>Section 2.3.2</em>&nbsp;&nbsp;<a href="#rfc.xref.Part4.3">3.2</a></li>
<li><em>Section 4.2.2</em>&nbsp;&nbsp;<a href="#rfc.xref.Part6.1">4.1</a></li>