Subject: #492: Alt-Svc header host restriction

From: Mark Nottingham <[email-masked]>
Date: Wed, 4 Jun 2014 12:11:46 -0400

All,

When we were originally working on Alt-Svc, Patrick and I put a restriction on the Alt-Svc header field so that it couldn’t redirect clients to a different host.

Since then, several people have pointed out that the requirement to have strong server authentication, as well as cache flushing, seems to contain the risk associated with doing this, and that the facility could be quite useful.

So, I’m suggesting we (re-) add the capability to the header.

[ I’ve opened <https://github.com/http2/http2-spec/issues/492> for this ]

--
Mark Nottingham   http://www.mnot.net/

---

From: Martin Thomson <[email-masked]>
Date: Wed, 4 Jun 2014 09:33:27 -0700

On Jun 4, 2014 9:15 AM, "Mark Nottingham" <[email-masked]> wrote:
>
> When we were originally working on Alt-Svc, Patrick and I put a
restriction on the Alt-Svc header field so that it couldn’t redirect
clients to a different host.
>
> Since then, several people have pointed out that the requirement to have
strong server authentication, as well as cache flushing, seems to contain
the risk associated with doing this, and that the facility could be quite
useful.

This sounds fine.

I think that this restriction still belongs in the -encryption draft.

---

From: Ryan Hamilton <[email-masked]>
Date: Wed, 4 Jun 2014 12:10:35 -0700

​​On Wed, Jun 4, 2014 at 9:33 AM, Martin Thomson <[email-masked]>
wrote:

>  think that this restriction still belongs in the -encryption draft.
>
​This also sounds good to me.​
​ In Chrome, we've had a number of different discussions about wanting to
do basically this. If the Alt-Svc header supported this functionality, that
would be awesome.​