Ballot for draft-ietf-cdni-edge-control-metadata

Discuss

Mahesh Jethanandani
Mohamed Boucadair

Yes

Gorry Fairhurst

No Objection

Andy Newton
Christopher Inacio
Deb Cooley
Éric Vyncke
Gunter Van de Velde
Jim Guichard
Ketan Talaulikar
Roman Danyliw
Tommy Jensen

No Record

Charles Eckel
Mike Bishop

Summary: Has 2 DISCUSSes. Has enough positions to pass once DISCUSS positions are resolved.

Mahesh Jethanandani
Discuss
Discuss (2026-04-27 for -11) Sent
I have three DISCUSS items that I would like some discussion around. Two of
them should be easy to fix, and Chris has already brought up the third one. Primarily, 
they are around normative use of a living standard, mention of FCI, 
and a naming inconsistency that would affect the IANA registry.

Section 3.1, paragraph 1
>    Cross-origin resource sharing (CORS) is a protocol that allows a HTTP
>    client application to access restricted resources from a server on a
>    domain different from the domain that served the original request.
>    It is defined by the Web Hypertext Application Technology Working
>    Group (WHATWG) Fetch Living Standard [WHATWG-FETCH].

This section and the following section make multiple normative (section
specific and definitional) references to [WHATWG-FETCH]. Despite this,
[WHATWG-FETCH] is listed as an Informative Reference (Section 10). 
A reference that defines the semantics of the protocol being specified 
cannot be informative. It must be Normative, as Chris points out, whose
DISCUSS position, I support.

However, moving it to Normative creates a second problem: WHATWG-FETCH 
is a living standard with no fixed version or stable section numbers. 
The section numbers cited in this document (3.1, 3.2.2, 3.3.2) may 
change without notice. RFC Editor policy discourages normative references 
to undated living standards because they can silently change the meaning 
of a published RFC.

The authors must either: (a) identify a stable, dated snapshot of the 
Fetch Standard that can be cited with stable section numbers, 
or (b) replace the normative dependencies on WHATWG-FETCH with equivalent 
references to RFC 6454 (The Web Origin Concept) and RFC 9110 for those 
definitions covered by published standards. The GENART reviewer (thanks, Elwyn Davies) 
recommended adding RFC 6454 precisely to address the Origin header ambiguity. 

Section 3.3.2, paragraph 1
> 3.3.2.  MI.AccessControlHeaders
> 
>    The MI.AccessControlAllowHeaders object has the following properties:

There is a naming inconsistency here between the Section title, the
body of the section, and the IANA registration request. These are two 
different names. The IANA table in Section 7 registers the payload 
type as MI.AccessControlHeaders. The IANA subsection 7.1.5 refers to 
it as MI.AccessControlHeaders. But this section's body uses 
MI.AccessControlAllowHeaders. Can this be fixed?

Section 6, paragraph 0
>    The FCI and MI objects defined in this document are transferred via
>    the interfaces defined in CDNI [RFC8006] which describes how to
>    secure these interfaces by protecting integrity and confidentiality
>    while ensuring the authenticity of the dCDN and uCDN.

This document does not define any FCI (Footprint and Capability Advertisement) 
objects. It defines only MI (Metadata Interface) objects. However, 
the IANA subsections (7.1.1–7.1.5) each say Interface: MI/FCI, 
suggesting the payload types can also be used for capability advertisement. 
If these payload types are intended for FCI use as well, the document 
should explain how and include any FCI-specific behavior. 
If they are MI-only, the IANA entries should say Interface: MI and 
Section 6 should not reference FCI.
Comment (2026-04-27 for -11) Sent
Section 2, paragraph 0
>    The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
>    "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
>    document are to be interpreted as described in [RFC2119].

This section cites only RFC 2119 for the BCP 14 keywords boilerplate. 
Per current IETF practice, RFC 8174 must also be cited. The standard 
boilerplate reads: "...described in BCP 14 [RFC2119] [RFC8174] when, 
and only when, they appear in all capitals..."

Section 3, paragraph 0
> 3.  MI.CrossoriginPolicy

The document references the Origin HTTP request header extensively 
in this section but never cites RFC 6454 ("The Web Origin Concept"), 
which is the IETF-standards-track definition of the Origin header. 
Regardless of how the WHATWG-FETCH dependency is resolved, RFC 6454 
should be cited when the Origin header is introduced. The GENART 
reviewer (Elwyn Davies, thanks, Elwyn) made this recommendation.

Section 4, paragraph 5
>    *  Description: If set to "true", the dCDN SHOULD try to compress the
>       response to the client based on the Accept-Encoding request header
>       and its available capabilities.  In case is not able to do the
>       compression, the content will be delivered uncompressed.

The normative SHOULD implies that a dCDN may choose not to compress even when 
instructed. But the fallback text says compression failure still delivers 
the content. This creates an ambiguity: is the SHOULD a soft recommendation 
that a dCDN can always ignore (rendering the flag meaningless), or does 
it mean "try compression, but failure is permissible"? If the intent is the 
latter, the language should be "the dCDN MUST attempt to compress the 
response... and MUST deliver the content uncompressed if compression is 
not possible." The grammar error (s/In case is not able/In case it is not able) 
should also be corrected.

Section 5, paragraph 0
>    Configuration metadata is required to define how connections to a
>    client are maintained by a dCDN.  In some use cases, like video
>    streaming or other critical object delivery, UA applications'
>    connection to the cache server must be managed to ensure the best
>    possible user experience.  This metadata allows a uCDN to accommodate
>    device-specific constraints and performance optimization.  A dCDN can
>    also benefit from this configuration metadata to meet its security
>    and resource consumption requirements.

The section's description says it is about "how connections to a client 
are maintained, and mentions "connection setup" in Section 5.1 
example caption, yet the only property defined is a keep-alive timeout. 
If the scope was intentionally limited to just this one property, 
a brief note explaining what was out of scope would prevent implementers 
from assuming other connection parameters (e.g., initial connection 
timeout, maximum connections) are implicitly configurable.
Mohamed Boucadair
Discuss
Discuss (2026-04-27 for -11) Sent
Hi Alfonso and Glenn, 

Thank you for the effort put into this document. 

Thank you to Sure Hares for the OPSDIR. The review is still to be addressed. Looking forward  addressing those comments per the recent note from Alfonso [1].

# Missing a reference to rfc6707

Several concepts in this document were defined in rfc6707 (metadata, upstream CDN, downstream CDN, etc.). Please add a mention that the document uses the terminology in rfc6707.

# What about retrieval? 

The document reasons about “configuring”, “setting”, etc. But what about retrieval of default behaviors? Such means are needed to detect anormal behaviors and adjust the behavior accordingly. 

Please consider adding a pointer to an existing spec to covers such aspects if such spec exists. If not, please consider adding an Operational Considerations Section that discusses the need to have such means and also to monitor the configuration in place. This is important to interop but also to detect misuse between *CDNs.

As I’m there, what are the guards in place to ensure that the configuration in place operates as expected? How that is monitored?

# CORS 

CURRENT:
   It is defined by the Web Hypertext Application Technology Working
   Group (WHATWG) Fetch Living Standard [WHATWG-FETCH].

   …
   MI.CrossoriginPolicy is a GenericMetadata object that allows
   configuring dynamically generated CORS headers.

[WHATWG-FETCH] should be listed as normative.
Comment (2026-04-27 for -11) Sent
# Extensions: Need and Integration in the CDNI System

I hesitated to list this as as DISCUSS because I do think this is important to assess the technical contribution and help understanding how the extensions can be integrated in an existing CDNI system.

There current introduction and section 3 are short in explaining how the new extension graft to existing CNDI component. Also, an explanation about the reasoning behind the set of required capabilities and how these capabilities are mapped to individual objects would strengthen the specification.

# Maybe cite rfc6454 in the following

CURRENT:
   While this transition is necessary for delivery, many User
   Agents apply strict 'same-origin' security restrictions to these
   network requests, which can block the content unless specific access
   rules are defined.


# More than two situations can occur: e.g., target resource may not exist at the first place

I suggest: 

OLD:
   Two situations can occur when
   one or more CDNs are involved in processing these requests:

NEW:
   At least, two situations can occur when
   one or more CDNs are involved in processing these requests:


# out of context

CURRENT:
   The dynamic generation of CORS headers is typical in modern HTTP
   request processing and avoids forwarding CORS headers to the uCDN,
   thereby reducing the load between dCDN and uCDN when the content to
   be delivered is already cached in the dCDN.

uCDN and dCDN are mentioned here while I don’t think it is true to say that there is always more than one CDN involved in the processing. The assumptions should be stated clearly.

Also, these are introduced while CDNI arch is not introduced first. 

# Inadequate use of normative language: s/MUST/must

CURRENT:
   The CDN Interconnection (CDNI) metadata model requires extensions to
   permit a uCDN to declare how a dCDN MUST evaluate and dynamically
   generate the necessary CORS response headers, avoiding the forwarding
   of CORS requests and/or preflight requests to the uCDN.

# (Lack of) Clarity again

CURRENT:
   Required capabilities:

Capabilities of which entities? Which system components?

Cheers,
Med

[1] https://mailarchive.ietf.org/arch/msg/ops-dir/oKvfnrMJAU6Bn49ufTLmPa7Yj6g/
Gorry Fairhurst
Yes
Andy Newton
No Objection
Christopher Inacio
(was Discuss) No Objection
Comment (2026-07-09) Sent
I would like to thank Elwyn D. for his comprehensive GENART review.  Elwyn has good suggestions beyond the one I will make in my comments in ways to strengthen the document further.  I believe this one issue is worth calling out a second time:

* Please expand the acronym (or make positive reference to RFC8006) to explain `uCDN` and `dCDN`
> 140	   The dynamic generation of CORS headers is typical in modern HTTP
> 141	   request processing and avoids forwarding CORS headers to the uCDN,
> 142	   thereby reducing the load between dCDN and uCDN when the content to
> 143	   be delivered is already cached in the dCDN.

Thanks for the updates to address my discuss points.  And my comments too.

Thanks
chris
Deb Cooley
No Objection
Comment (2026-04-27 for -11) Not sent
I support the discusses by Chris and Eric.
Éric Vyncke
(was Discuss) No Objection
Comment (2026-07-09) Sent
Thanks for the work done in this document and for addressing my previous blocking DISCUSS ballot: https://mailarchive.ietf.org/arch/msg/cdni/o4Gg3s217xP6KUGYPHI_o67Okpo/
Gunter Van de Velde
No Objection
Comment (2026-04-27 for -11) Not sent
the boilerplate template used seems outdated:

90	2.  Requirements

92	   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
93	   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
94	   document are to be interpreted as described in [RFC2119].

Should look something as follows:

"
   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
   "OPTIONAL" in this document are to be interpreted as described in BCP
   14 [RFC2119] [RFC8174] when, and only when, they appear in all
   capitals, as shown here.
"
Jim Guichard
No Objection
Ketan Talaulikar
No Objection
Comment (2026-04-27 for -11) Not sent
Thanks to the authors and the WG for their work on this document.

I find that Eric has already caught all the comments that I had and hence skipping the email out.
Roman Danyliw
No Objection
Comment (2026-04-29 for -11) Sent
Thank you to Elwyn Davies for the GENART review.

I support the DISCUSS positions of Christopher Inacio, Mahesh Jethanandani, and Mohamed Boucadair on the how the [WHATWG-FETCH] reference is treated -- it needs to be normative and point to a specific reference.

In previous discussions on WHATWG references in documents, specific github commit messages with a date stamp were referenced.
Tommy Jensen
No Objection
Comment (2026-04-30 for -11) Not sent
I support the existing DISCUSSes but think this is ready to publish after those are addressed.
Charles Eckel
No Record
Mike Bishop
No Record