Subject: Migrating a spec to structured fields

From: Roberto Polli <[email-masked]>
Date: Tue, 9 Mar 2021 17:53:20 +0100

Hi folks,

I wanted to migrate the RateLimit headers with roughly the following abnf to S-F

```
RateLimit-Limit = expiring-limit [, 1#quota-policy ]
expiring-limit = request-quota
quota-policy = request-quota; "w" "=" time-window *( OWS ";" OWS quota-comment)
quota-comment = token "=" (token / quoted-string)
request-quota = quota-units
quota-units = 1*DIGIT
time-window = delay-seconds (from Section 10.2.4 of [SEMANTICS])
```

I stubbed a commentable doc here
https://docs.google.com/document/d/1e9Vxcmb6hrle8LNKMtQc_eB-p7jdEPrBE1lgzrAqYKo/edit
for all the willing people that are happy to provide hints.
This could become a useful migration guide/reference to foster S-F adoption.

Thanks for your help,
R.

---

From: Justin Richer <[email-masked]>
Date: Tue, 9 Mar 2021 16:24:02 -0500

Roberto,

Thank you for providing this transition document, I think that collecting these will be helpful. I went through a similar exercise formally defining the new header format for Message Signatures in this pending PR:

https://github.com/httpwg/http-extensions/pull/1411 <https://github.com/httpwg/http-extensions/pull/1411>

We don’t have a full ABNF in there yet, but I’m seeing that we should add that in a future PR now and this is a good example of how to incorporate the fields and formats. We’ll have similar restrictions, like the expiration being non-negative.

And from an engineering perspective, I also pulled together both a client and server implementation of the signatures draft based on that PR, and using a Structure Fields library from Julian I was able to get it together in relatively short order as a result. Having a deterministic serialization for structured data is REALLY helpful for a security standard, so it’s been good to move in that direction.

 — Justin

> On Mar 9, 2021, at 11:53 AM, Roberto Polli <[email-masked]> wrote:
> 
> Hi folks,
>

---

From: Julian Reschke <[email-masked]>
Date: Wed, 10 Mar 2021 09:15:23 +0100

> This could become a useful migration guide/reference to foster S-F adoption.

IIUC, the proposal is to use ABNF to specify constraints:

   delay-seconds = sf-integer ; non-negative Integer without parameters

and then to use "delay-seconds" instead of "sf-integer".

I'm not convinced this is a good idea, because if you use structured
fields, there are more things to worry about (extension parameters etc),
so at the end of the say you will have to use prose to specify
additional behaviours anyway. It probably is better to have all of that
in a single place.

Best regards, Julian

---

From: Carsten Bormann <[email-masked]>
Date: Wed, 10 Mar 2021 09:28:11 +0100

On 2021-03-10, at 09:15, Julian Reschke <[email-masked]> wrote:
> 
> the proposal is to use ABNF

Yeah, I was worried about that, too.

Instead of using ABNF for JSON texts, we have languages like CDDL.

Maybe something should be done now for structured HTTPheaders.
(It will be easy to add that to CDDL, if you want.)

Grüße, Carsten