Subject: Re: i24: Requiring Allow in 405 responses

From: Robert Sayre <[email-masked]>
Date: Thu, 6 Mar 2008 19:33:22 -0800

> Exactly. We're not here to re-design Allow or come up with a better
> mechanism; just to clarify what it means today.
>
> To reiterate, my proposal:
>
> > "The actual set of allowed methods is defined by the origin server
> > at the time of each request."
> >
> > to
> >
> > "The actual set of allowed methods is defined by the origin server
> > at the time of each request, and may not necessarily include all (or
> > any) methods that the server would actually allow in a request if
> > presented."
>

Looks good to me.

- Rob

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 11 Mar 2008 15:35:38 +1100

My understanding is that a proposal along these lines* is acceptable,  
with one exception; Julian believes that if we do this, we should also  
relax the client-side requirement.

One way to do that would be to change "SHOULD"->"should" (i.e., make  
it advisory text, instead of a requirement).

Thoughts?

* In my mind,the "the"->"a" proposal is roughly equivalent to the  
proposed text below.

--
Mark Nottingham     http://www.mnot.net/

---

From: Julian Reschke <[email-masked]>
Date: Tue, 11 Mar 2008 09:05:16 +0100

> relax the client-side requirement.

Yes.

> One way to do that would be to change "SHOULD"->"should" (i.e., make it 
> advisory text, instead of a requirement).
> 
> Thoughts?
> ...

I don't think that lowercasing the requirement is sufficient; it's still 
a requirement. My proposal is to get rid of it, so to drop:

"However, the indications given by the Allow header field value SHOULD 
be followed."

completely.

BR, Julian

---

From: "Roy T. Fielding" <[email-masked]>
Date: Tue, 11 Mar 2008 10:54:11 -0700

On Mar 11, 2008, at 1:05 AM, Julian Reschke wrote:
> Mark Nottingham wrote:
>> My understanding is that a proposal along these lines* is  
>> acceptable, with one exception; Julian believes that if we do  
>> this, we should also relax the client-side requirement.
>
> Yes.
>
>> One way to do that would be to change "SHOULD"->"should" (i.e.,  
>> make it advisory text, instead of a requirement).
>> Thoughts?
>> ...
>
> I don't think that lowercasing the requirement is sufficient; it's  
> still a requirement. My proposal is to get rid of it, so to drop:
>
> "However, the indications given by the Allow header field value  
> SHOULD be followed."
>
> completely.

+1

....Roy

---

From: Julian Reschke <[email-masked]>
Date: Wed, 12 Mar 2008 13:14:23 +0100

Roy T. Fielding wrote:
>>> with one exception; Julian believes that if we do this, we should 
>>> also relax the client-side requirement.
>>
>> Yes.
>>

OK,

here's my proposal:

Change

"This field cannot prevent a client from trying other methods. However, 
the indications given by the Allow header field value SHOULD be 
followed. The actual set of allowed methods is defined by the origin 
server at the time of each request."

to

"This field cannot prevent a client from trying other methods. The 
actual set of allowed methods is defined by the origin server at the 
time of each request, and may not necessarily include all (or any) 
methods that the server would actually allow in a request if presented."

This relaxes the server requirement (reflecting reality), and 
accordingly removes the requirement for clients to trust the information.

BR, Julian

---

From: Henrik Nordstrom <[email-masked]>
Date: Thu, 13 Mar 2008 22:43:20 +0100

> accordingly removes the requirement for clients to trust the information.

With this we could just as well deprecate Allow completely as there is
no longer any defined use of the header.

I am still of the opinion that obeying what Allow says should be a
SHOULD level requirement on the client, and consequently a SHOULD or
MUST level requirement on the server to provide meaningful information.

It's not very important if a 405 includes Allow or not however, but your
proposed change is outside of 405 processing and applies to the
processing of any response. I certainly don't object to making Allow a
SHOULD (or maybe even MAY) requirement in 405 instead of a MUST. But it
should be a SHOULD level requirement in OPTIONS and the clients use of
methods.

Regards
Henrik