Subject: #34: Alt-Svc-Used indicator granularity

From: Mark Nottingham <[email-masked]>
Date: Wed, 21 Jan 2015 17:01:28 +1100

<https://github.com/httpwg/http-extensions/issues/34>

We took a hum about this in HNL, where it seemed that most people needed more discussion.

The proposals we discussed were:

1) no alt-svc-used indicator  (some support)
2) 1-bit indicator    (no support)
3) multi-bit indicator    (a little support - one hummer?)
4) full hostname    (some support)
5) 1-bit or full hostname   (some support)
6) don't know   (most "support")

Interestingly, though, there was no(!) support for the current solution, one bit.

How do people feel now? 

My personal take -- From what I can tell, most of the uncertainty here is around the privacy properties of the indicator, and people seem to agree that the risk of abuse is present, but not severe. 

That seems to indicate something like "SHOULD send the alternative service hostname in the Alt-Svc-Used header field value, unless the client has been explicitly configured not to send it."

This would allow browsers in privacy mode or similar to not send it, while still giving servers the kind of feedback they need; if a server really needs Alt-Svc-Used, they can 421 or drop the connection, and the client will stay where it was. In that sense, it's sort of in the spirit of #5.

How do people feel about that? Or, are there alternative (hah) proposals?

Cheers,

--
Mark Nottingham   https://www.mnot.net/

---

From: Julian Reschke <[email-masked]>
Date: Wed, 21 Jan 2015 12:10:01 +0100

On 2015-01-21 07:01, Mark Nottingham wrote:
> ...

Sounds good to me.

Best regards, Julian

---

From: Martin Thomson <[email-masked]>
Date: Wed, 21 Jan 2015 09:35:22 -0800

On 21 January 2015 at 03:10, Julian Reschke <[email-masked]> wrote:
>> That seems to indicate something like "SHOULD send the alternative service
>> hostname in the Alt-Svc-Used header field value, unless the client has been
>> explicitly configured not to send it."
>
> Sounds good to me.

Likewise.  I could almost live with a MUST now, though I'm not
confident enough that I've thought through all the corner cases, and
would definitely prefer the option to not send.

The thing that turned me on this was the fact that the request is
going to the same origin.  If the site wants to track you across the
redirect, it can just use a cookie.  As long as any AltSvc state
shares fate with cookies, this is only a case of clients helping
servers with some tricky deployment issues; the client isn't actually
giving anything away (unless you count the opportunity cost of the
bytes, that is).

---

From: Erik Nygren <[email-masked]>
Date: Tue, 27 Jan 2015 17:34:54 -0500

Sounds good to me as well.

Best regards, Erik

On Wed, Jan 21, 2015 at 6:10 AM, Julian Reschke <[email-masked]>
wrote:

>> My personal take -- From what I can tell, most of the uncertainty here is
>> around the privacy properties of the indicator, and people seem to agree
>> that the risk of abuse is present, but not severe.
>>
>> That seems to indicate something like "SHOULD send the alternative
>> service hostname in the Alt-Svc-Used header field value, unless the client
>> has been explicitly configured not to send it."
>>
>> This would allow browsers in privacy mode or similar to not send it,
>> while still giving servers the kind of feedback they need; if a server
>> really needs Alt-Svc-Used, they can 421 or drop the connection, and the
>> client will stay where it was. In that sense, it's sort of in the spirit of
>> #5.
>>

---

From: Mark Nottingham <[email-masked]>
Date: Wed, 28 Jan 2015 10:09:32 +1100

Thanks, Erik.

Does anyone else have comment / concern here?

Cheers,

> On 28 Jan 2015, at 9:34 am, Erik Nygren <[email-masked]> wrote:
> 
> On Wed, Jan 21, 2015 at 6:10 AM, Julian Reschke <[email-masked]> wrote:

---

From: Matthew Kerwin <[email-masked]>
Date: Wed, 28 Jan 2015 13:21:42 +1000

> Does anyone else have comment / concern here?
​I'm pretty firmly in the #6 camp, but I don't see any real problems with
your suggestion.​

-- 
  Matthew Kerwin
  http://matthew.kerwin.net.au/

---

From: Julian Reschke <[email-masked]>
Date: Thu, 29 Jan 2015 17:41:08 +0100

> Does anyone else have comment / concern here?

OK, so we're going back to 
<http://greenbytes.de/tech/webdav/draft-ietf-httpbis-alt-svc-01.html#service>:

> 4. The Service HTTP Header Field
>
> The Service HTTP header field is used in requests to indicate the identity of the alternate service in use, just as the Host header field identifies the host and port of the origin.
>
> Service = uri-host [ ":" port ]
>
> Service is intended to allow alternate services to detect loops, differentiate traffic for purposes of load balancing, and generally to ensure that it is possible to identify the intended destination of traffic, since introducing this information after a protocol is in use has proven to be problematic.
>
> When using an Alternate Service, clients MUST include a Service header in all requests.
>
> For example:
>
> GET /thing
> Host: origin.example.com
> Service: alternate.example.net
> User-Agent: Example/1.0

...except the header field name stays "Alt-Used", and the MUST becomes a 
SHOULD?

Will we still need the extension parameters?

Best regards, Julian

---

From: Mark Nottingham <[email-masked]>
Date: Fri, 30 Jan 2015 15:49:12 +1100

Think so...

> On 30 Jan 2015, at 3:41 am, Julian Reschke <[email-masked]> wrote:
> 
> OK, so we're going back to <http://greenbytes.de/tech/webdav/draft-ietf-httpbis-alt-svc-01.html#service>:
> 
> ...except the header field name stays "Alt-Used", and the MUST becomes a SHOULD?
>

---

From: Julian Reschke <[email-masked]>
Date: Fri, 30 Jan 2015 14:59:09 +0100

> Think so...

-> 
<https://github.com/httpwg/http-extensions/commit/7c5cc0174dd0f26a9e8dcb028ef4baf4f58feef4>

Best regards, Julian