A Guide to the HTTP/1.1 Document Series
draft-kucherawy-httpbis-summary-00

HTTPBIS Working Group                                  M. Kucherawy, Ed.
Internet-Draft                                           Cloudmark, Inc.
Intended status: Informational                            March 27, 2012
Expires: September 28, 2012

                A Guide to the HTTP/1.1 Document Series
                   draft-kucherawy-httpbis-summary-00

Abstract

   This document introduces a series of documents that comprise the
   definition of HTTP/1.1, providing a short summary of the content of
   each of those.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at http://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on September 28, 2012.

Copyright Notice

   Copyright (c) 2012 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Kucherawy              Expires September 28, 2012               [Page 1]
Internet-Draft          HTTP/1.1 Document Series              March 2012

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . . . 3
   2.  Documents . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
     2.1.  Part 1: URIs, Connections, and Message Parsing  . . . . . . 3
     2.2.  Part 2: Message Semantics . . . . . . . . . . . . . . . . . 4
     2.3.  Part 3: Message Payload and Content Negotiation . . . . . . 5
     2.4.  Part 4: Conditional Requests  . . . . . . . . . . . . . . . 6
     2.5.  Part 5: Range Requests and Partial Responses  . . . . . . . 6
     2.6.  Part 6: Caching . . . . . . . . . . . . . . . . . . . . . . 7
     2.7.  Part 7: Authentication  . . . . . . . . . . . . . . . . . . 7
   3.  IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 8
   4.  Security Considerations . . . . . . . . . . . . . . . . . . . . 8
   5.  Informative References  . . . . . . . . . . . . . . . . . . . . 8
   Appendix A.  Acknowledgements . . . . . . . . . . . . . . . . . . . 9

Kucherawy              Expires September 28, 2012               [Page 2]
Internet-Draft          HTTP/1.1 Document Series              March 2012

1.  Introduction

   This document summarizes the series of documents comprising the
   definition of HTTP/1.1.  A synopsis of each document is provided,
   also describing key procedural components of each document (e.g.,
   IANA considerations and major security-related topics).  This is
   intended to serve as a super table of contents for the series.

2.  Documents

2.1.  Part 1: URIs, Connections, and Message Parsing

   Part 1 ([HTTP-PART-1]) provides an overview of HTTP and its
   associated terminology, defines the "http" and "https" Uniform
   Resource Identifier (URI) schemes, defines the generic message syntax
   and parsing requirements for HTTP message frames, and describes
   general security concerns for implementations.

   IANA actions include:

   o  Registration of the following HTTP-specific header fields:

      *  Close

      *  Connection

      *  Content-Length

      *  Host

      *  TE

      *  Trailer

      *  Transfer-Encoding

      *  Upgrade

      *  Via

   o  Registration of the "http" and "https" URI schemes

   o  Registration of the "message/http" and "application/http" media
      types

   o  Creates the HTTP Transfer Coding Registry and creates its initial
      entries

Kucherawy              Expires September 28, 2012               [Page 3]
Internet-Draft          HTTP/1.1 Document Series              March 2012

   o  Creates the HTTP Upgrade Token Registry and creates its initial
      entries

   Security considerations include:

   o  Personal information

   o  Abuse of server log information

   o  Attacks based on file and path names

   o  DNS-related attacks

   o  Intermediaries and caching

   o  Protocol element size overflows

2.2.  Part 2: Message Semantics

   Part 2 ([HTTP-PART-2]) defines the semantics of HTTP messages as
   expressed by request methods, request header fields, response status
   codes, and response header fields.

   IANA Actions include:

   o  Creation of the HTTP Request Method Registry and registration of
      its initial entries

   o  Creation of the HTTP Status Code Registry and registration of its
      initial entries

   o  Registration of the following HTTP-specific header fields:

      *  Allow

      *  Date

      *  Expect

      *  From

      *  Location

      *  Max-Forwards

      *  Referer

Kucherawy              Expires September 28, 2012               [Page 4]
Internet-Draft          HTTP/1.1 Document Series              March 2012

      *  Server

      *  User-Agent

   Security considerations include:

   o  Transfer of sensitive information

   o  Encoding sensitive information in URIs

   o  Location header fields: spoofing an information leakage

   o  Issuse with the CONNECT method

2.3.  Part 3: Message Payload and Content Negotiation

   Part 3 ([HTTP-PART-3]) defines HTTP message content, metadata, and
   content negotiation.

   IANA Actions include:

   o  Registration of the following HTTP-specific header fields:

      *  Accept

      *  Accept-Charset

      *  Accept-Encoding

      *  Accept-Language

      *  Content-Encoding

      *  Content-Language

      *  Content-Location

      *  Content-Type

      *  MIME-Version

   o  Creates the HTTP Content Codings registry and defines its initial
      values

   Security considerations include:

   o  Privacy issues connected to Accept header fields

Kucherawy              Expires September 28, 2012               [Page 5]
Internet-Draft          HTTP/1.1 Document Series              March 2012

2.4.  Part 4: Conditional Requests

   Part 4 ([HTTP-PART-4]) defines request header fields for indicating
   conditional requests and the rules for constructing responses to
   those requests.

   IANA Actions include:

   o  Registration of the following HTTP Status Codes:

      *  304: Not Modified

      *  412: Precondition Failed

   o  Registration of the following HTTP-specific header fields:

      *  ETag

      *  If-Match

      *  If-Modified-Since

      *  If-None-Match

      *  If-Unmodified-Since

      *  Last-Modified

2.5.  Part 5: Range Requests and Partial Responses

   Part 5 ([HTTP-PART-5]) defines range-specific requests and the rules
   for constructing and combining responses to those requests.

   IANA Actions include:

   o  Registration of the following HTTP Status Codes:

      *  206: Partial Content

      *  416: Requested Range Not Satisfiable

   o  Registration of the following HTTP-specific header fields:

      *  Accept-Ranges

      *  Content-Range

Kucherawy              Expires September 28, 2012               [Page 6]
Internet-Draft          HTTP/1.1 Document Series              March 2012

      *  If-Range

      *  Range

   o  Creates the HTTP Range Specifiers registry and its initial entry

   Security considerations include:

   o  Overlapping ranges

2.6.  Part 6: Caching

   Part 6 ([HTTP-PART-6]) defines requirements on HTTP caches and the
   associated header fields that control cache behavior or indicate
   cacheable response messages.

   IANA Actions include:

   o  Creates the HTTP Cache Directives registry and its initial entries

   o  Creates the HTTP Warn Codes registry and its initial entries

   o  Registration of the following HTTP-specific header fields:

      *  Age

      *  Cache-Control

      *  Expires

      *  Pragma

      *  Vary

      *  Warning

   Security considerations include:

   o  General discussion of security issues related to caching

2.7.  Part 7: Authentication

   Part 7 ([HTTP-PART-7]) defines the HTTP Authentication framework.

   IANA Actions include:

   o  Creates the HTTP Authenticaton Schemes registry

Kucherawy              Expires September 28, 2012               [Page 7]
Internet-Draft          HTTP/1.1 Document Series              March 2012

   o  Registration of the following HTTP Status Codes:

      *  401: Unauthorized

      *  407: Proxy Authentication Required

   o  Registration of the following HTTP-specific header fields:

      *  Authorization

      *  Proxy-Authenticate

      *  Proxy-Authorization

      *  WWW-Authenticate

   Security considerations include:

   o  Authentication credentials and idle clients

3.  IANA Considerations

   This document includes no actions for IANA.

4.  Security Considerations

   This document neither introduces nor modifies any protocol and as
   such has no security implications.

5.  Informative References

   [HTTP-PART-1]  Fielding, R., Ed., Lafon, Y., Ed., and J. Reschke,
                  Ed., "HTTP/1.1, part 1: URIs, Connections, and Message
                  Parsing", draft-ietf-httpbis-p1-messaging (work in
                  progress), March 2012.

   [HTTP-PART-2]  Fielding, R., Ed., Lafon, Y., Ed., and J. Reschke,
                  Ed., "HTTP/1.1, part 2: Message Semantics",
                  draft-ietf-httpbis-p2-semantics (work in progress),
                  March 2012.

   [HTTP-PART-3]  Fielding, R., Ed., Lafon, Y., Ed., and J. Reschke,
                  Ed., "HTTP/1.1, part 3: Message Payload and Content
                  Negotiation", draft-ietf-httpbis-p3-payload (work in
                  progress), March 2012.

   [HTTP-PART-4]  Fielding, R., Ed., Lafon, Y., Ed., and J. Reschke,
                  Ed., "HTTP/1.1, part 4: Conditional Requests",

Kucherawy              Expires September 28, 2012               [Page 8]
Internet-Draft          HTTP/1.1 Document Series              March 2012

                  draft-ietf-httpbis-p4-conditional (work in progress),
                  March 2012.

   [HTTP-PART-5]  Fielding, R., Ed., Lafon, Y., Ed., and J. Reschke,
                  Ed., "HTTP/1.1, part 5: Range Requests and Partial
                  Responses", draft-ietf-httpbis-p5-range (work in
                  progress), March 2012.

   [HTTP-PART-6]  Fielding, R., Ed., Lafon, Y., Ed., and J. Reschke,
                  Ed., "HTTP/1.1, part 6: Caching",
                  draft-ietf-httpbis-p6-cache (work in progress),
                  March 2012.

   [HTTP-PART-7]  Fielding, R., Ed., Lafon, Y., Ed., and J. Reschke,
                  Ed., "HTTP/1.1, part 7: Authentication",
                  draft-ietf-httpbis-p7-auth (work in progress),
                  March 2012.

Appendix A.  Acknowledgements

   The author wishes to acknowledge the following for their input to
   this document: (names)

Author's Address

   Murray S. Kucherawy (editor)
   Cloudmark, Inc.
   128 King St., 2nd Floor
   San Francisco, CA  94107
   US

   Phone: +1 415 946 3800
   EMail: msk@cloudmark.com

Kucherawy              Expires September 28, 2012               [Page 9]