Source: https://tools.ietf.org/wg/httpbis/draft-ietf-httpbis-p6-cache/draft-ietf-httpbis-p6-cache-26-from-25.diff.html
Timestamp: 2017-07-23 06:49:18
Document Index: 377064129

Matched Legal Cases: ['art1', 'art1', 'art2', 'art2', 'art7', 'art7', 'art7', 'art7', 'art2', 'art2', 'art1']

Diff: draft-ietf-httpbis-p6-cache-25.txt - draft-ietf-httpbis-p6-cache-26.txt draft-ietf-httpbis-p6-cache-25.txt draft-ietf-httpbis-p6-cache-26.txt HTTPbis Working Group R. Fielding, Ed. HTTPbis Working Group R. Fielding, Ed.
Expires: May 21, 2014 J. Reschke, Ed. Expires: August 10, 2014 J. Reschke, Ed.
November 17, 2013 February 6, 2014
draft-ietf-httpbis-p6-cache-25 draft-ietf-httpbis-p6-cache-26
The Hypertext Transfer Protocol (HTTP) is an application-level The Hypertext Transfer Protocol (HTTP) is a stateless application-
protocol for distributed, collaborative, hypertext information level protocol for distributed, collaborative, hypertext information
systems. This document defines requirements on HTTP caches and the systems. This document defines HTTP caches and the associated header
associated header fields that control cache behavior or indicate fields that control cache behavior or indicate cacheable response
cacheable response messages. messages.
This Internet-Draft will expire on May 21, 2014. This Internet-Draft will expire on August 10, 2014.
Copyright (c) 2013 IETF Trust and the persons identified as the Copyright (c) 2014 IETF Trust and the persons identified as the
skipping to change at page 3, line 19 skipping to change at page 3, line 19
5.2. Cache-Control . . . . . . . . . . . . . . . . . . . . . . 21 5.2. Cache-Control . . . . . . . . . . . . . . . . . . . . . . 21
5.5.1. Warning: 110 - "Response is Stale" . . . . . . . . . . 31 5.5.1. Warning: 110 - "Response is Stale" . . . . . . . . . . 30
7.1.3. Registrations . . . . . . . . . . . . . . . . . . . . 33 7.1.3. Registrations . . . . . . . . . . . . . . . . . . . . 32
D.1. Since draft-ietf-httpbis-p6-cache-24 . . . . . . . . . . . 40 D.1. Since draft-ietf-httpbis-p6-cache-24 . . . . . . . . . . . 40
D.2. Since draft-ietf-httpbis-p6-cache-25 . . . . . . . . . . . 40
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
cache stores cacheable responses in order to reduce the response time cache stores cacheable responses in order to reduce the response time
and network bandwidth consumption on future, equivalent requests. and network bandwidth consumption on future, equivalent requests.
Any client or server MAY employ a cache, though a cache cannot be Any client or server MAY employ a cache, though a cache cannot be
dedicated to a single user. dedicated to a single user; often, they are deployed as a component
Section 4.2, if the response can be reused without "validation" Section 4.2, if the response can be reused without "validation"
can be freshened by validation (Section 4.3) or if the origin is can be freshened by validation (Section 4.3) or if the origin is
skipping to change at page 4, line 47 skipping to change at page 4, line 48
notation of [RFC5234] with the list rule extension defined in Section notation of [RFC5234] with a list extension, defined in Section 7 of
7 of [Part1]. Appendix B describes rules imported from other [Part1], that allows for compact definition of comma-separated lists
documents. Appendix C shows the collected ABNF with the list rule using a '#' operator (similar to how the '*' operator indicates
expanded. repetition). Appendix B describes rules imported from other
documents. Appendix C shows the collected grammar with all list
A recipient parsing a delta-seconds value and converting it to binary A recipient parsing a delta-seconds value and converting it to binary
form ought to use an arithmetic type of at least 31 bits of non- form ought to use an arithmetic type of at least 31 bits of non-
skipping to change at page 5, line 34 skipping to change at page 5, line 35
are performed with an arithmetic type incapable of directly are performed with an arithmetic type incapable of directly
representing that number. What matters here is that an overflow representing that number. What matters here is that an overflow
be detected and not treated as a negative value in later be detected and not treated as a negative value in later
HTTP, we assume that reusing the cached response is desirable and HTTP, it can be assumed that reusing a cached response is desirable
that such reuse is the default behavior when no requirement or local and that such reuse is the default behavior when no requirement or
configuration prevents it. Therefore, HTTP cache requirements are local configuration prevents it. Therefore, HTTP cache requirements
focused on preventing a cache from either storing a non-reusable are focused on preventing a cache from either storing a non-reusable
response or reusing a stored response inappropriately, rather than response or reusing a stored response inappropriately, rather than
mandating that caches always store and reuse particular responses. mandating that caches always store and reuse particular responses.
retrieval request: i.e., a 200 (OK) response to a GET request, which retrieval request: i.e., a 200 (OK) response to a GET request, which
contains a representation of the resource identified by the request contains a representation of the resource identified by the request
target (Section 4.3.1 of [Part2]). However, it is also possible to target (Section 4.3.1 of [Part2]). However, it is also possible to
cache permanent redirects, negative results (e.g., 404 (Not Found)), cache permanent redirects, negative results (e.g., 404 (Not Found)),
skipping to change at page 6, line 26 skipping to change at page 6, line 27
o the "no-store" cache directive (see Section 5.2) does not appear o the "no-store" cache directive (see Section 5.2) does not appear
o the "private" cache response directive (see Section 5.2.2.6) does o the "private" response directive (see Section 5.2.2.6) does not
not appear in the response, if the cache is shared, and appear in the response, if the cache is shared, and
o the Authorization header field (see Section 4.1 of [Part7]) does o the Authorization header field (see Section 4.2 of [Part7]) does
* contains an Expires header field (see Section 5.3), or * contains an Expires header field (see Section 5.3), or
* contains a max-age response cache directive (see * contains a max-age response directive (see Section 5.2.2.8), or
Section 5.2.2.8), or * contains a s-maxage response cache directive (see * contains a s-maxage response directive (see Section 5.2.2.9)
Section 5.2.2.9) and the cache is shared, or and the cache is shared, or
* has a status code that is defined as cacheable by default (see * has a status code that is defined as cacheable by default (see
* contains a public response cache directive (see * contains a public response directive (see Section 5.2.2.5).
Section 5.2.2.5). Note that any of the requirements listed above can be overridden by a Note that any of the requirements listed above can be overridden by a
skipping to change at page 7, line 41 skipping to change at page 7, line 40
Authorization header field (Section 4.1 of [Part7]) to satisfy any Authorization header field (Section 4.2 of [Part7]) to satisfy any
directives (Section 5.2.2) have such an effect: must-revalidate, directives (Section 5.2.2) have such an effect: must-revalidate,
(Section 4.2.4) by shared caches. In particular, a response with (Section 4.2.4) by shared caches. In particular, a response with
skipping to change at page 11, line 12 skipping to change at page 11, line 8
either the Expires header field (Section 5.3) or the max-age response either the Expires header field (Section 5.3) or the max-age response
cache directive (Section 5.2.2.8). Generally, origin servers will directive (Section 5.2.2.8). Generally, origin servers will assign
assign future explicit expiration times to responses in the belief future explicit expiration times to responses in the belief that the
that the representation is not likely to change in a semantically representation is not likely to change in a semantically significant
significant way before the expiration time is reached. way before the expiration time is reached.
subsequent requests (see Section 4.2.4). subsequent requests (see Section 4.2.4).
time under certain circumstances (see Section 4.2.2). time under certain circumstances (see Section 4.2.2).
skipping to change at page 12, line 18 skipping to change at page 12, line 12
resource. See Section 6 for an explanation of the difference between resource. See Section 6 for an explanation of the difference between
4.2.1. Calculating Freshness Lifetime 4.2.1. Calculating Freshness Lifetime
o If the cache is shared and the s-maxage response cache directive o If the cache is shared and the s-maxage response directive
(Section 5.2.2.9) is present, use its value, or (Section 5.2.2.9) is present, use its value, or
o If the max-age response cache directive (Section 5.2.2.8) is o If the max-age response directive (Section 5.2.2.8) is present,
present, use its value, or use its value, or
o If the Expires response header field (Section 5.3) is present, use o If the Expires response header field (Section 5.3) is present, use
Section 4.2.2. Section 4.2.2.
skipping to change at page 13, line 7 skipping to change at page 12, line 50
whose status codes are defined as cacheable by default (see Section whose status codes are defined as cacheable by default (see Section
6.1 of [Part2]), and those responses without explicit freshness that 6.1 of [Part2]), and those responses without explicit freshness that
have been marked as explicitly cacheable (e.g., with a "public" have been marked as explicitly cacheable (e.g., with a "public"
response cache directive). response directive).
skipping to change at page 19, line 25 skipping to change at page 19, line 25
When a cache makes an inbound HEAD request for a given request target When a cache makes an inbound HEAD request for a given request target
and receives a 200 (OK) response, the cache SHOULD update or and receives a 200 (OK) response, the cache SHOULD update or
invalidate each of its stored GET responses that could have been invalidate each of its stored GET responses that could have been
selected for that request (see Section 4.1). selected for that request (see Section 4.1).
For each of the stored responses that could have been selected, if For each of the stored responses that could have been selected, if
the stored response and HEAD response have matching values for any the stored response and HEAD response have matching values for any
received validator fields (ETag and Last-Modified) and, if the HEAD received validator fields (ETag and Last-Modified) and, if the HEAD
response has a Content-Length header field, the value of Content- response has a Content-Length header field, the value of Content-
Length matches that of the stored response, the cache SHOULD update Length matches that of the stored response, the cache SHOULD update
the stored response a described below; otherwise, the cache SHOULD the stored response as described below; otherwise, the cache SHOULD
consider the stored response to be stale. consider the stored response to be stale.
If a cache updates a stored response with the metadata provided in a If a cache updates a stored response with the metadata provided in a
HEAD response, the cache MUST: HEAD response, the cache MUST:
code 1xx (see Section 5.5); code 1xx (see Section 5.5);
skipping to change at page 26, line 45 skipping to change at page 26, line 45
This directive uses the token form of the argument syntax; e.g., This directive uses the token form of the argument syntax; e.g.,
's-maxage=10', not 's-maxage="10"'. A sender SHOULD NOT generate the 's-maxage=10', not 's-maxage="10"'. A sender SHOULD NOT generate the
quoted-string form. quoted-string form.
or more cache-extension tokens, each with an optional value. or more cache-extension tokens, each with an optional value. A cache
MUST ignore unrecognized cache directives.
directives. Behavioral extensions are designed to work by acting as directives.
modifiers to the existing base of cache directives. Both the new directive and the standard directive are supplied, such that applications that do not understand the new directive will default to the behavior specified by the standard directive, and those that understand the new directive will recognize it as modifying the requirements associated with the standard directive. In this way, extensions to the cache-control directives can be made without requiring changes to the base protocol. This extension mechanism depends on an HTTP cache obeying all of the Behavioral extensions are designed to work by acting as modifiers to
cache-control directives defined for its native HTTP-version, obeying the existing base of cache directives. Both the new directive and
certain extensions, and ignoring all directives that it does not the old directive are supplied, such that applications that do not
understand. understand the new directive will default to the behavior specified
by the old directive, and those that understand the new directive
will recognize it as modifying the requirements associated with the
old directive. In this way, extensions to the existing cache-control
directives can be made without breaking deployed caches.
"community" that acts as a modifier to the private directive. We "community" that acts as a modifier to the private directive: in
define this new directive to mean that, in addition to any private addition to private caches, any cache that is shared only by members
cache, any cache that is shared only by members of the community of the named community is allowed to cache the response. An origin
named within its value is allowed to cache the response. An origin server wishing to allow the UCI community to use an otherwise private server wishing to allow the UCI community to use an otherwise private
A cache seeing this header field will act correctly even if the cache A cache that recognizes such a community cache-extension could
does not understand the community cache-extension, since it will also broaden its behavior in accordance with that extension. A cache that
see and understand the private directive and thus default to the safe does not recognize the community cache-extension would ignore it and
behavior. adhere to the private directive.
A cache MUST ignore unrecognized cache directives; it is assumed that any cache directive likely to be unrecognized by an HTTP/1.1 cache will be combined with standard directives (or the response's default cacheability) such that the cache behavior will remain minimally correct even if the cache does not understand the extension(s). 5.3. Expires 5.3. Expires
response is considered stale. See Section 4.2 for further discussion response is considered stale. See Section 4.2 for further discussion
skipping to change at page 30, line 40 skipping to change at page 30, line 29
If a sender generates one or more 1xx warn-codes in a message to be If a sender generates one or more 1xx warn-codes in a message to be
sent to a recipient known to implement only HTTP/1.0, the sender MUST sent to a recipient known to implement only HTTP/1.0, the sender MUST
include in each corresponding warning-value a warn-date that matches include in each corresponding warning-value a warn-date that matches
the Date header field in the message. For example: the Date header field in the message. For example:
Date: Sat, 25 Aug 2012 23:34:45 GMT Date: Sat, 25 Aug 2012 23:34:45 GMT
Warning: 112 - "network down" "Sat, 25 Aug 2012 23:34:45 GMT" Warning: 112 - "network down" "Sat, 25 Aug 2012 23:34:45 GMT"
Warnings have accompanying warn-text that describes the error, e.g.,
for logging. It is advisory only, and its content does not affect
interpretation of the warn-code.
If a recipient that uses, evaluates, or displays Warning header If a recipient that uses, evaluates, or displays Warning header
fields receives a warn-date that is different from the Date value in fields receives a warn-date that is different from the Date value in
the same message, the recipient MUST exclude the warning-value the same message, the recipient MUST exclude the warning-value
containing that warn-date before storing, forwarding, or using the containing that warn-date before storing, forwarding, or using the
message. This allows recipients to exclude warning-values that were message. This allows recipients to exclude warning-values that were
improperly retained after a cache validation. If all of the warning- improperly retained after a cache validation. If all of the warning-
values are excluded, the recipient MUST exclude the Warning header values are excluded, the recipient MUST exclude the Warning header
field as well. field as well.
skipping to change at page 34, line 43 skipping to change at page 34, line 43
| Pragma | http | standard | Section 5.4 | | Pragma | http | standard | Section 5.4 |
| Warning | http | standard | Section 5.5 | | Warning | http | standard | Section 5.5 |
and users of known security concerns specific to HTTP/1.1 caching. and users of known security concerns specific to HTTP caching. More
More general security considerations are addressed in HTTP messaging general security considerations are addressed in HTTP messaging
Furthermore, the very use of a cache can bring about privacy In particular, various attacks might be amplified by being stored in
concerns. For example, if two users share a cache, and the first one a shared cache; such "cache poisoning" attacks use the cache to
browses to a site, the second may be able to detect that the other distribute a malicious payload to many clients, and are especially
has been to that site, because the resources from it load more effective when an attacker can use implementation flaws, elevated
quickly, thanks to the cache. privileges, or other techniques to insert such a response into a
cache. One common attack vector for cache poisoning is to exploit
Implementation flaws might allow attackers to insert content into a differences in message parsing on proxies and in user agents; see
cache ("cache poisoning"), leading to compromise of clients that Section 3.3.3 of [Part1] for the relevant requirements.
trust that content. Because of their nature, these attacks are difficult to mitigate. Likewise, implementation flaws (as well as misunderstanding of cache Likewise, implementation flaws (as well as misunderstanding of cache
Furthermore, the very use of a cache can bring about privacy
concerns. For example, if two users share a cache, and the first one
browses to a site, the second may be able to detect that the other
has been to that site, because the resources from it load more
quickly, thanks to the cache.
draft-ietf-httpbis-p1-messaging-25 (work in progress), draft-ietf-httpbis-p1-messaging-26 (work in progress),
November 2013. February 2014.
draft-ietf-httpbis-p2-semantics-25 (work in progress), draft-ietf-httpbis-p2-semantics-26 (work in progress),
draft-ietf-httpbis-p4-conditional-25 (work in progress), draft-ietf-httpbis-p4-conditional-26 (work in progress),
draft-ietf-httpbis-p5-range-25 (work in progress), draft-ietf-httpbis-p5-range-26 (work in progress),
draft-ietf-httpbis-p7-auth-25 (work in progress), draft-ietf-httpbis-p7-auth-26 (work in progress),
skipping to change at page 37, line 30 skipping to change at page 37, line 34
performing invalidation have been clarified. (Section 4.4) performing invalidation have been clarified. (Section 4.4)
received. (Section 4.4) received. (Section 4.4)
Cache directives are explicitly defined to be case-insensitive. Cache directives are explicitly defined to be case-insensitive.
Handling of multiple instances of cache directives when only one is Handling of multiple instances of cache directives when only one is
expected is now defined. (Section 5.2) expected is now defined. (Section 5.2)
The "no-store" cache request directive doesn't apply to responses; The "no-store" request directive doesn't apply to responses; i.e., a
i.e., a cache can satisfy a request with no-store on it, and does not cache can satisfy a request with no-store on it, and does not
invalidate it. (Section 5.2.1.5) invalidate it. (Section 5.2.1.5)
(Section 5.2.2) (Section 5.2.2)
The "no-cache" response cache directive's meaning has been clarified. The "no-cache" response directive's meaning has been clarified.
(Section 5.2.2.2) (Section 5.2.2.2)
The one-year limit on Expires header field values has been removed; The one-year limit on Expires header field values has been removed;
instead, the reasoning for using a sensible value is given. instead, the reasoning for using a sensible value is given.
(Section 5.3) (Section 5.3)
The Pragma header field is now only defined for backwards The Pragma header field is now only defined for backwards
compatibility; future pragmas are deprecated. (Section 5.4) compatibility; future pragmas are deprecated. (Section 5.4)
Some requirements regarding production and processing of the Warning Some requirements regarding production and processing of the Warning
skipping to change at page 40, line 18 skipping to change at page 40, line 18
o <http://tools.ietf.org/wg/httpbis/trac/ticket/499>: "RFC 1305 ref o <http://tools.ietf.org/wg/httpbis/trac/ticket/499>: "RFC 1305 ref
needs to be updated to 5905" needs to be updated to 5905"
o <http://tools.ietf.org/wg/httpbis/trac/ticket/500>: "dangling o <http://tools.ietf.org/wg/httpbis/trac/ticket/500>: "dangling
reference to cacheable status codes" reference to cacheable status codes"
o <http://tools.ietf.org/wg/httpbis/trac/ticket/512>: "APPSDIR o <http://tools.ietf.org/wg/httpbis/trac/ticket/512>: "APPSDIR
review of draft-ietf-httpbis-p6-cache-24" review of draft-ietf-httpbis-p6-cache-24"
o <http://tools.ietf.org/wg/httpbis/trac/ticket/535>: "IESG ballot
on draft-ietf-httpbis-p6-cache-25"
o <http://tools.ietf.org/wg/httpbis/trac/ticket/542>: "improve
introduction of list rule"
o <http://tools.ietf.org/wg/httpbis/trac/ticket/549>: "augment
security considerations with pointers to current research"
110 (warn-code) 31 110 (warn-code) 30
skipping to change at page 41, line 48 skipping to change at page 42, line 16
proxy-revalidate (cache directive) 26 proxy-revalidate (cache directive) 26
Response is Stale (warn-text) 31 Response is Stale (warn-text) 30
End of changes. 43 change blocks. 97 lines changed or deleted 112 lines changed or added