The Hypertext Transfer Protocol Status Code 308 (Permanent Redirect)
draft-ietf-httpbis-rfc7238bis-03

[Ballot comment]
"This specification contains no technical changes from the experimental RFC 7238, which it obsoletes."

Then why are we wasting time with a new document?

[Ballot comment]
Thanks for addressing my prior discuss with some text in the security considerations section to explain the following is possible without TLS:

Couldn't an attacker substitute the URI that the user gets permanently redirected to a malicious site or a competitor, etc.?  The security considerations of RFC7231 are pretty thorough, but I didn't see mention of using TLS to prevent session interception for this type of attack or for the privacy protection section.

[Ballot discuss]
I have a question on the security considerations, since the session isn't necessarily encrypted. 

Couldn't an attacker substitute the URI that the user gets permanently redirected to a malicious site or a competitor, etc.?  The security considerations of RFC7231 are pretty thorough, but I didn't see mention of using TLS to prevent session interception for this type of attack or for the privacy protection section.

If I missed something, please let me know where to look.

Thank you.

[Ballot comment]
I found the text below a bit confusing:

      Note: This status code is similar to 301 (Moved Permanently)
      ([RFC7231], Section 6.4.2), except that it does not allow changing
      the request method from POST to GET.

The issue is that if you permanently cache this redirect, then there is no request, and hence no request method to change.  I think that what you mean is that if the request that produced the 308 result was a POST, then the redirect is only valid for future POSTs, and if it was a GET, it's only valid for future GETs.  I'm fairly confident this is what you intended to say, and the text as is could be read that way, but it might be better expressed this way:

      Note: This status code is similar to 301 (Moved Permanently)
      ([RFC7231], Section 6.4.2), except that it applies only to future
      requests with the same method.  For example, if the 308 status
      code is received in response to a request with a method of
      GET, then the redirect only applies to future requests that
      also have a method of GET.

This also possibly addresses my other probably naive question, which is whether this applies to request methods other than GET and POST.

[Ballot comment]
I found the text below a bit confusing:

      Note: This status code is similar to 301 (Moved Permanently)
      ([RFC7231], Section 6.4.2), except that it does not allow changing
      the request method from POST to GET.

The issue is that if you permanently cache this redirect, then there is no request, and hence no request method to change.  I think that what you mean is that if the request that produced the 308 result was a POST, then the redirect is only valid for future POSTs, and if it was a GET, it's only valid for future GETs.  I'm fairly confident this is what you intended to say, and the text as is could be read that way, but it might be better expressed this way:

      Note: This status code is similar to 301 (Moved Permanently)
      ([RFC7231], Section 6.4.2), except that it applies only to future
      requests with the same method.  For example, if the 308 status code
      is received in response to a request with a method of GET, then
      the redirect only applies to future requests that also have a method
      of GET.

This also possibly addresses my other probably naive question, which is whether this applies to request methods other than GET and POST.

IESG/Authors/WG Chairs:

IANA has reviewed draft-ietf-httpbis-rfc7238bis-02.  Authors should review the comments and/or questions below.  Please report any inaccuracies and respond to any questions as soon as possible.

We received the following comments/questions from the IANA's reviewer:

IANA understands that, upon approval of this document, there is a single action which IANA must complete.

In the HTTP Status Codes registry located at:

http://www.iana.org/assignments/http-status-codes/

IANA will update the reference for the existing registration 308 as follows:

OLD:
308 Permanent Redirect [RFC7238]

NEW:
308 Permanent Redirect [ RFC-to-be ]

IANA understands that this is the only action that needs to be completed upon approval of this document.

Note:  The actions requested in this document will not be completed until the document has been approved for publication as an RFC. This message is only to confirm what actions will be performed. 

Please note that IANA cannot reserve specific values. However, early allocation is available for some types of registrations. For more information, please see RFC 7120.

The following Last Call announcement was sent out:

From: The IESG
To: IETF-Announce
CC:
Reply-To: ietf@ietf.org
Sender:
Subject: Last Call:  (The Hypertext Transfer Protocol Status Code 308 (Permanent Redirect)) to Proposed Standard


The IESG has received a request from the Hypertext Transfer Protocol WG
(httpbis) to consider the following document:
- 'The Hypertext Transfer Protocol Status Code 308 (Permanent Redirect)'
  as Proposed Standard

This changes the status of RFC 7238 to Proposed Standard, from
Experimental.  We initially handled this with a status-change document,
but needed to abandon that when a minor change came up in Section 4.

The IESG plans to make a decision in the next few weeks, and solicits
final comments on this action. Please send substantive comments to the
ietf@ietf.org mailing lists by 2015-01-28. Exceptionally, comments may be
sent to iesg@ietf.org instead. In either case, please retain the
beginning of the Subject line to allow automated sorting.

Abstract

  This document specifies the additional Hypertext Transfer Protocol
  (HTTP) status code 308 (Permanent Redirect).


The file can be obtained via
http://datatracker.ietf.org/doc/draft-ietf-httpbis-rfc7238bis/

When IESG discussion begins, it can be tracked via
http://datatracker.ietf.org/doc/draft-ietf-httpbis-rfc7238bis/ballot/

No IPR declarations have been submitted directly on this I-D.

1. Summary

Mark Nottingham is document shepherd and Working Group Chair. Barry
Leiba is the responsible Area Director.

This document specifies the additional Hypertext Transfer Protocol
(HTTP) status code 308 (Permanent Redirect). It is a republication of
RFC7238 with no technical changes, to update the status from
Experimental to Proposed Standard, since there has been good deployment
experience with the status code.

2. Review and Consensus

At IETF 90, Julian Reschke made a presentation about the state of the
current HTTP RFCs, including 7238:
  http://httpwg.github.io/wg-materials/ietf90/ietf-90-httpbis-progressing.pdf

There, he demonstrated that support for the 308 status code was good in
deployed implementations:
  http://greenbytes.de/tech/tc/httpredirects/#l-308

... and suggested that this being the case, we update the status of the
document from Experimental to Proposed Standard.

Broad support for doing so was expressed at the meeting, and confirmed
on-list.

3. Intellectual Property

Julian confirms that he has no direct, personal knowledge of IPR related
to this document.

No other disclosures regarding this document have been made.

4. Other Points

This document has no downward references, and the IANA Considerations
seem appropriate. Since this is a direct copy of RC7238, additional
review did not seem necessary.

We initially tried to handle this with a status-change document, but
that had to be abandoned when we decided on a minor change in Section 4.

1. Summary

Mark Nottingham is document shepherd and Working Group Chair. Barry Leiba is the responsible Area Director.

This document specifies the additional Hypertext Transfer Protocol (HTTP) status code 308 (Permanent Redirect). It is a republication of RFC7238 with no technical changes, to update the status from Experimental to Proposed Standard, since there has been good deployment experience with the status code.

2. Review and Consensus

At IETF 90, Julian Reschke made a presentation about the state of the current HTTP RFCs, including 7238:
  http://httpwg.github.io/wg-materials/ietf90/ietf-90-httpbis-progressing.pdf

There, he demonstrated that support for the 308 status code was good in deployed implementations:
  http://greenbytes.de/tech/tc/httpredirects/#l-308

... and suggested that this being the case, we update the status of the document from Experimental to Proposed Standard.

Broad support for doing so was expressed at the meeting, and confirmed on-list.

3. Intellectual Property

Julian confirms that he has no direct, personal knowledge of IPR related to this document.

No other disclosures regarding this document have been made.

4. Other Points

This document has no downward references, and the IANA Considerations seem appropriate. Since this is a direct copy of RC7238, additional review did not seem necessary.

It might be useful to mention the document's relationship to RFC7238 in the abstract.