Subject: Re: Weak validators in conditional requests

From: Mark Nottingham <[email-masked]>
Date: Tue, 4 Sep 2018 12:01:37 +1000

Hi Eduard,

> On 28 Aug 2018, at 7:54 pm, Eduard Bagdasaryan <[email-masked]> wrote:
> 
> Hello,
> 
> 
> Could you please help with the following two questions:
> 
> 1. The old RFC 2616 has a MUST requirement:
> 
>> A cache or origin server receiving a conditional request, other than
>> a full-body GET request, MUST use the strong comparison function to
>> evaluate the condition.
> 
> But I have not found this (or equivalent) in HTTPbis. Is it deprecated?

It's stated in the definition of each conditional header; see:
  https://httpwg.org/specs/rfc7232.html#preconditions

Cheers,

> 
> 2. RFC 7233 Appendix B states:
> 
>> A weak validator cannot be used in a 206 response. (Section 4.1)
> 
> However, I do not see any explicit 'weak validator' restrictions in
> 4.1 Section. Am I missing something?
> 
> 
> Thank you,
> Ed
> 
> 
> 
> 

--
Mark Nottingham   https://www.mnot.net/

---

From: Eduard Bagdasaryan <[email-masked]>
Date: Tue, 4 Sep 2018 14:09:37 +0300

Yes, it is stated there, but only about If-Match and If-None-Match
headers. What about If-Modified-Since, If-Unmodified-Since
and If-Range?

---

From: Julian Reschke <[email-masked]>
Date: Tue, 4 Sep 2018 14:40:59 +0200

On 9/4/2018 1:09 PM, Eduard Bagdasaryan wrote:
> ...

See 
<https://greenbytes.de/tech/webdav/rfc7232.html#changes.from.rfc.2616> - 
so this was an intentional change.

Best regards, Julian

---

From: Eduard Bagdasaryan <[email-masked]>
Date: Fri, 7 Sep 2018 02:41:58 +0300

Thanks, but 2616 changes mention only entity tags:
"Weak entity-tags are now allowed in all requests except range
requests.",
not considering If-Modified-Since, If-Unmodified-Since and
If-Range, I am concerned in.

Let's see an example: a proxy cached a response,
having two headers below:

[...]
Date: Tue, 15 Aug 2018 12:36:57 GMT
Last-Modified: Tue, 15 Aug 2018 12:36:27 GMT
[...]

According to https://tools.ietf.org/html/rfc7232#section-2.2.2,
we would need to use weak validator for Last-Modified
time, since the difference between these two fields
is less than 60 seconds.

Some time later, a client requests this cached resource
with a range GET request:

[...]
If-Unmodified-Since: Tue, 15 Aug 2016 12:36:27 GMT
Range: bytes=0-5
[...]

Can the proxy respond with 206 answer?
If no, are there any MUSTs in HTTPbis, prohibiting this?

On 04.09.2018 15:40, Julian Reschke wrote:
> <https://greenbytes.de/tech/webdav/rfc7232.html#changes.from.rfc.2616> 
> - so this was an intentional change.
>
> Best regards, Julian

---

From: Julian Reschke <[email-masked]>
Date: Fri, 7 Sep 2018 12:18:48 +0200

> If-Range, I am concerned in.

Hm.

May the change should have been described as "weak *validators* are now 
allowed..."?

Best regards, Julian

---

From: Eduard Bagdasaryan <[email-masked]>
Date: Sun, 16 Sep 2018 00:56:58 +0300

Note that the phrase "Weak entity-tags are now allowed..."
is taken from RFC7232 Appendix A, describing differences
with RFC2616. It would be pointless to change it
into "weak *validators* are now allowed..." without fixing the
corresponding RFC7232 sections (3.3, 3.4 and 3.5). In other
words, your suggestion would require adding
"A recipient MUST use the weak comparison function..." into
3.3, 3.4 and 3.5 sections.

 > 4.1 Section.

On 07.09.2018 13:18, Julian Reschke wrote:
> May the change should have been described as "weak *validators* are 
> now allowed..."?
>
> Best regards, Julian