Well-Known URIs for the WebSocket Protocol
draft-bormann-hybi-ws-wk-00

Received changes through RFC Editor sync (created alias RFC 8307, changed title to 'Well-Known URIs for the WebSocket Protocol', changed abstract to 'RFC 5785 defines a path prefix, "/.well-known/", that can be used by well-known URIs.  It was specifically defined for the "http" and "https" URI schemes.  The present memo formally updates RFC 6455, which defines the URI schemes defined for the WebSocket Protocol, to extend the use of these well-known URIs to those URI schemes.', changed standardization level to Proposed Standard, changed state to RFC, added RFC published event at 2018-01-02, changed IESG state to RFC Published, created updates relation between draft-bormann-hybi-ws-wk and RFC 6455)

[Ballot discuss]
Document: draft-bormann-hybi-ws-wk-00.txt

  It has always been possible to form "ws" and "wss" URIs in such a way
  that they map to well-known HTTP(S) URIs when using the procedure in
  Section 4 of [RFC6455], so no new security considerations about this
  are created by now formally making the well-known URI mechanism
  available for "ws" and "wss", as well.
 
  However, with well-known URIs becoming available for the WebSocket
  protocol, applications that want to define well-known URI suffixes
  specifically for WebSocket use also need to consider whether the
  resources becoming available under the equivalent HTTP(S) URI formed
  by Section 4 of [RFC6455] pose any information disclosure or other
  security considerations.

I'm not sure I am persuaded by this. The issue is that clients assume
that these URIs have elevated privilege, so if it's not the case
that WebSockets servers behave this way, we can't retroactively declare
it. Can you explain in more detail why you think this is safe?

(Via drafts-lastcall@iana.org): IESG/Authors/WG Chairs:

The IANA Services Operator has reviewed draft-bormann-hybi-ws-wk-00.txt, which is currently in Last Call, and has the following comments:

We understand that this document doesn't require any registry actions.

While it's often helpful for a document's IANA Considerations section to remain in place upon publication even if there are no actions, if the authors strongly prefer to remove it, we do not object.

If this assessment is not accurate, please respond as soon as possible.

Thank you,

Sabrina Tanamal
IANA Services Specialist
PTI

The following Last Call announcement was sent out:

From: The IESG
To: IETF-Announce
CC: alexey.melnikov@isode.com, draft-bormann-hybi-ws-wk@ietf.org
Reply-To: ietf@ietf.org
Sender:
Subject: Last Call:  (Well-known URIs for the WebSocket Protocol) to Proposed Standard


The IESG has received a request from an individual submitter to consider the
following document: - 'Well-known URIs for the WebSocket Protocol'
  as Proposed Standard

The IESG plans to make a decision in the next few weeks, and solicits final
comments on this action. Please send substantive comments to the
ietf@ietf.org mailing lists by 2017-07-19. Exceptionally, comments may be
sent to iesg@ietf.org instead. In either case, please retain the beginning of
the Subject line to allow automated sorting.

Abstract


  RFC 5785 defines a path prefix, "/.well-known/", that can be used by
  well-known URIs, specifically for the "http" and "https" URI schemes.
  The present memo formally updates RFC 6455, which defines the URI
  schemes defined for the WebSocket Protocol, to extend the use of
  these well-known URIs to those URI schemes.




The file can be obtained via
https://datatracker.ietf.org/doc/draft-bormann-hybi-ws-wk/

IESG discussion can be tracked via
https://datatracker.ietf.org/doc/draft-bormann-hybi-ws-wk/ballot/


No IPR declarations have been submitted directly on this I-D.