Prefer Header for HTTP
draft-snell-http-prefer-18

[Ballot comment]

-16 addressed my other comments, (thanks), not sure if these
were missed or not but don't think I saw any response

- Is "relation types" correct in section 4, 1st para?

- 4.3, where is delta-seconds defined?

[Ballot comment]
Given that the document points to the similarity between Prefer and Expect, consider being explicit about not using tokens defined for Prefer in Expect header fields and vice-versa. You might also provide guidance about whether to use the same token in both if you are defining a behavior that would make sense to use in both places.

Did you consider whether a client would ever need to say "I prefer thing X most, Y if you won't do that, and Z if you wont't do that"? Does anything here prevent adding something later that would capture that semantic? (I don't think so, parameters could be added to group preferences and give them weights for instance).

Why isn't the SHOULD in "The Prefer header field is end-to-end and SHOULD be forwarded unless" not a MUST?

Do you want to say anything about the order of parameters on a given header field value being significant or not? (Do you inherit a not from the base spec?)

[Ballot comment]

- Is "relation types" correct in section 4, 1st para?

- 4.3, where is delta-seconds defined?

- 4.3, I'm surprised that the smallest wait time is 1s.

- 4.4, if strict and lenient are mutually-exclusive then is
there a missing statement that a request MUST NOT contain both,
or do you fall back to the earlier rule that the server assumes
the client meant the first one seen?

- section 6 implies (but doesn't quite require) that newly
registered preferences ought say something about security, but
you don't give the expert any guidance on that, (e.g. to say
that there should be security considerations - there will be in
an RFC but who knows about other specifications) and you don't
say anything about the initial registrations. I'm not sure
what's right here but would you expect the expert to say "no"
if someone wanted to register a preference called "cc"
with a URI parameter and meaning "please send
there"? If so, wouldn't it be good to give some guidance to
the expert that it'd be ok to say no if the registration
would open up serious new vulnerabilities?

[Ballot discuss]
2

  Implementations MUST support multiple instances of the Prefer header
  field in a single message, as well as multiple preference tokens
  separated by commas in a single Prefer header field.  The following
  examples are equivalent:

I think this is worded a bit oddly. The requirement is that the multiple instances be treated as identical to a single instance with multiple comma-separated token/value pairs. That's defining the semantics, not a particular behavior requiring a MUST. Now, maybe the intention was to say that receiving implementations MUST *honor* multiple instances of the Prefer header field, but that's incompatible with the earlier comment that a server is allowed to ignore any preference it feels like. So my recommendation is simply to rewrite this as:

  A client MAY use multiple instances of the Prefer header field in a
  single message, or it MAY use a single Prefer header field with
  multiple comma-separated preference tokens. If multiple Prefer header
  fields are used, it is equivalent to a single Prefer header filed
  with the comma-separated concatentation of all of the tokens. For
  example, the following are equivalent:
 
4

  Registered preference names MUST conform to the token rule, and MUST
  be compared character-by-character in a case-insensitive fashion.

This is not a restriction for *registered* preference names; this is a restriction for *any* preference name. I think this belongs in section 2 (and probably would be fine without the MUSTs). If you are putting it here to give guidelines to the Expert Reviewer, put a back pointer to section 2 by saying, "The Expert Reviewer shall ensure that the registered preference name conforms to the token rule in section 2 and that it is not identical to any other registered preference name (as compared in a case-insensitive fashion).

  They SHOULD be appropriate to the specificity of the preference;
  i.e., if the semantics are highly specific to a particular
  application, the name should reflect that, so that more general names
  remain available for less specific use.

That SHOULD is a noop, unless as above this is simply instructions for the Expert Reviewer, in which case the SHOULD is unnecessary.

  Registered preferences MUST NOT constrain servers, clients or any
  intermediaries involved in the exchange and processing of a request
  to any behavior required for successful processing.  The use and
  application of a preference within a given request MUST be optional
  on the part of all participants.

I don't really understand what the first sentence means, certainly not in the context of the MUST NOT. Is this simply saying, "Choose a name such that generic names are reserved for generic operations"? The second sentence belongs in section 2.


4.2

  The "return-minimal" and "return-representation" preferences are
  mutually exclusive directives.  A request that contains both
  preferences can be treated as though neither were specified.
 
This worries me a bit. There are clear instructions for what a server is supposed to do if it sees duplicate preferences: Choose the first one. But here, both occurring means to honor neither of them. I don't get that. If you have mutually exclusive preferences, it seems to me they should simply be values of a single preference. In this case, why not have the preference be:

  Prefer: return-amount=representation
  Prefer: return-amount=minimal

Then you don't get into questions of anybody having to figure out what are mutually exclusive semantics.
 
4.4

  The "strict" and "lenient" preferences are mutually-exclusive
  directives

Same as above. How about:

  Prefer: handling=strict
  Prefer: handling=lenient

IANA has reviewed draft-snell-http-prefer-14 and has the following comments:

IANA has a question about the IANA actions requested in this document.

IANA understands that, upon approval of this document, there are two actions
which IANA must complete.

First, in the Permanent Message Header Field Names registry located at:

http://www.iana.org/assignments/message-headers/perm-headers.html

a new header is to be registered as follows:

Header Field Name: Prefer
Protocol: http
Status:
Reference: [ RFC-to-be ]

Currently the Permanent Message Header Field Names registry is maintained
through expert review as defined in RFC 5226.

IANA Question -> has the document been reviewed by the Permanent Message Header
Field Names registry expert?

Second, IANA is to create a new sub-registry in the Hypertext Transfer Protocol
(HTTP) Parameters registry at:

http://www.iana.org/assignments/http-parameters/http-parameters.xml

The new registry is to be called "HTTP Preferences"

New registrations will use the Specification Required and Expert Review policies
as defined in RFC 5226.

Registration requests consist of the completed registration template in [
RFC-to-be], typically published in an RFC or Open Standard as defined by RFC 2026.
The Designated Expert can approve registration once they are satisfied that a
specification will be published.

There are initial registrations in the new HTTP Preferences sub-registry as
follows:

Preference: return-asynch
Description: Indicates that the client prefers the server to respond
asynchronously to a request.
Reference: [ RFC-to-be ]

Preference: return-minimal
Description: Indicates that the client prefers the server return a minimal
response to a request.
Reference: [ RFC-to-be ]

Preference: return-representation
Description: Indicates that the client prefers the server to include a
representation of the current state of the resource in response to a request.
Reference: [ RFC-to-be ]

Preference: wait
Description: Indicates an upper bound to the lenght of time the client is
willing to wait for a response, after which the request can be aborted.
Reference: [ RFC-to-be ]

Preference: strict
Description: Indicates that the client wishes the server to apply strict
validation and error handling to the processing of a request.
Reference: [ RFC-to-be ]

Preference: lenient
Description: Indicates that the client wishes the server to apply lenient
validation and error handling to the processing of a request.
Reference: [ RFC-to-be ]

IANA understands that these two actions are the only ones required to be
completed by IANA upon approval of this document.

Note: The actions requested in this document will not be completed until the
document has been approved for publication as an RFC.

The following Last Call announcement was sent out:

From: The IESG
To: IETF-Announce
Reply-To: ietf@ietf.org
Subject: Last Call:  (Prefer Header for HTTP) to Proposed Standard


The IESG has received a request from an individual submitter to consider
the following document:
- 'Prefer Header for HTTP'
  as Proposed Standard

The IESG plans to make a decision in the next few weeks, and solicits
final comments on this action. Please send substantive comments to the
ietf@ietf.org mailing lists by 2012-10-12. Exceptionally, comments may be
sent to iesg@ietf.org instead. In either case, please retain the
beginning of the Subject line to allow automated sorting.

Abstract


  This specification defines an HTTP header field that can be used by a
  client to request that certain behaviors be implemented by a server
  while processing a request.




The file can be obtained via
http://datatracker.ietf.org/doc/draft-snell-http-prefer/

IESG discussion can be tracked via
http://datatracker.ietf.org/doc/draft-snell-http-prefer/ballot/


No IPR declarations have been submitted directly on this I-D.

Document shepherd writeup (Mark Nottingham):

(1) What type of RFC is being requested (BCP, Proposed Standard,
Internet Standard, Informational, Experimental, or Historic)? Why is
this the proper type of RFC? Is this type of RFC indicated in the
title page header?

Proposed Standard. This is appropriate for this document, although
Informational would also be workable.

(2) The IESG approval announcement includes a Document Announcement
Write-Up. Please provide such a Document Announcement Write-Up. Recent
examples can be found in the "Action" announcements for approved
documents. The approval announcement contains the following sections:

Technical Summary:
This specification defines an HTTP header field that can be used by a
client to request that certain behaviors be implemented by a server
while processing a request.

Working Group Summary:
This is not a Working Group document, but it has been discussed
extensively on the HTTPbis WG mailing list, and has had an informal
Last Call there. There seems to be broad consensus to publish it, and
no significant issues remain.

Document Quality:
Implementation is forthcoming in Apache Abdera, and this specification
is referenced by Microsoft's OData protocol. Other non-public
implementations have been discussed but not disclosed.

It has gone under substantial review and change based upon that
review. It is expected that this mechanism will be used mostly by
"API" applications of HTTP, rather than in Web browsers, so HTTP
implementations per se don't need to support it specifically.

Personnel:
Mark Nottingham is the Document Shepherd.
Barry Leiba is the Responsible Area Director.

(3) Briefly describe the review of this document that was performed by
the Document Shepherd. If this version of the document is not ready
for publication, please explain why the document is being forwarded to
the IESG.

I went through this form, and rolled my eyes a bit when I read this
question.

(4) Does the document Shepherd have any concerns about the depth or
breadth of the reviews that have been performed?

No.

(5) Do portions of the document need review from a particular or from
broader perspective, e.g., security, operational complexity, AAA, DNS,
DHCP, XML, or internationalization? If so, describe the review that
took place.

The most relevant review would probably be security; it hasn't been
done specifically, but the Security Considerations seems adequate to
this reviewer.

(6) Describe any specific concerns or issues that the Document
Shepherd has with this document that the Responsible Area Director
and/or the IESG should be aware of? For example, perhaps he or she is
uncomfortable with certain parts of the document, or has concerns
whether there really is a need for it. In any event, if the WG has
discussed those issues and has indicated that it still wishes to
advance the document, detail those concerns here.

None.

(7) Has each author confirmed that any and all appropriate IPR
disclosures required for full conformance with the provisions of BCP
78 and BCP 79 have already been filed. If not, explain why?

Yes.

(8) Has an IPR disclosure been filed that references this document? If
so, summarize any WG discussion and conclusion regarding the IPR
disclosures.

None.

(9) How solid is the WG consensus behind this document? Does it
represent the strong concurrence of a few individuals, with others
being silent, or does the WG as a whole understand and agree with it?

It's been discussed by a number of active Working Group members (on
the order of 13 people, not including the author).

(10) Has anyone threatened an appeal or otherwise indicated extreme
discontent? If so, please summarise the areas of conflict in separate
email messages to the Responsible Area Director. (It should be in a
separate email because this questionnaire is publicly available.)

No.

(11) Identify any ID nits the Document Shepherd has found in this
document. (See http://www.ietf.org/tools/idnits/ and the
Internet-Drafts Checklist). Boilerplate checks are not enough; this
check needs to be thorough.

IDNits identified minor issues which were discussed with the
responsible AD and disposed of.

(12) Describe how the document meets any required formal review
criteria, such as the MIB Doctor, media type, and URI type reviews.

N/A

(13) Have all references within this document been identified as
either normative or informative?

Yes.

(14) Are there normative references to documents that are not ready
for advancement or are otherwise in an unclear state? If such
normative references exist, what is the plan for their completion?

There are references to the HTTPbis documents, which should be
entering LC soon.

(15) Are there downward normative references references (see RFC
3967)? If so, list these downward references to support the Area
Director in the Last Call procedure.

No.

(16) Will publication of this document change the status of any
existing RFCs? Are those RFCs listed on the title page header, listed
in the abstract, and discussed in the introduction? If the RFCs are
not listed in the Abstract and Introduction, explain why, and point to
the part of the document where the relationship of this document to
the other RFCs is discussed. If this information is not in the
document, explain why the WG considers it unnecessary.

No.

(17) Describe the Document Shepherd's review of the IANA
considerations section, especially with regard to its consistency with
the body of the document. Confirm that all protocol extensions that
the document makes are associated with the appropriate reservations in
IANA registries. Confirm that any referenced IANA registries have been
clearly identified. Confirm that newly created IANA registries include
a detailed specification of the initial contents for the registry,
that allocations procedures for future registrations are defined, and
a reasonable name for the new registry has been suggested (see RFC
5226).

The document registers a new HTTP header, as per RFC3864, using the
RFC publication process; therefore, it will be reviewed as the
document moves forward.

It also creates a new registry of "HTTP Preferences".

(18) List any new IANA registries that require Expert Review for
future allocations. Provide any public guidance that the IESG would
find useful in selecting the IANA Experts for these new registries.

The "HTTP Preferences" registry requires Expert Review, through its
use of Specification Required.  The designated experts should be
familiar with the HTTP protocol and its use.

(19) Describe reviews and automated checks performed by the Document
Shepherd to validate sections of the document written in a formal
language, such as XML code, BNF rules, MIB definitions, etc.

The Shepherd has hand-checked the (minimal) BNF in the document.